Splunk Enterprise Security

Is there any way to to compare two different log sources to get the output

cdev24
New Member

Hi Experts,

I need your help to create query to show output when a system is infected with any malware\virus (Source anti virus)and same is generating traffic (strong textsource firewall)

Challenge I am facing is that in Antivirus log infected host is dest_ip and in firewall logs source is src_ip.

Other thing is I am unable to find any common field between two logs (Anti virus and Firewall)

Sample logs for Anti virus :

"2016-12-29 12:43:26" Type="SecurityIncident", RowID="AACDE705-F0A9-46B0-BE27-C0ECF81554A7", Name="MalwareInfection", Description="NotImplemented", Timestamp=1451418206600, SchemaVersion="1.0", ObserverHost="hostname", ObserverUser=0, ObserverProductName="SystemCenterEndpointProtection", ObserverProductversion="4.8.0204.0", ObserverProtectionType="AM", ObserverProtectionVersion=0, ObserverProtectionSignatureVersion=0, ObserverDetection="Realtime", ObserverDetectionTime=1451418206600, ActorHost=0, ActorUser=0, ActorProcess=0, ActorResource=0, ActionType="MalwareInfection", TargetHost="Thost", TargetUser="Tuser", TargetProcess="C:\Windows\explorer.exe", TargetResource="file:_E:\O F F I C E\PDFCreatorWebSetup.exe", ClassificationID=2147697638, ClassificationType="Trojan:Win32/Dorv.B!rfn", ClassificationSeverity="Severe", ClassificationCategory="Trojan", RemediationType="Quarantine", RemediationResult="True", RemediationErrorCode=0, RemediationPendingAction="NoActionRequired", IsActiveMalware="False"

Sample logs of Firewall

Dec 29 15:18:38 FHost 1,2015/12/29 15:18:38,007701001134,TRAFFIC,drop,1,2015/12/29 15:18:32,80.82.79.104,10.X.X.X,0.0.0.0,0.0.0.0,LOG-OUTSIDE,,,not-applicable,vs1,OUTSIDE,INSIDE,ethernet1/1,,Forward to Panorama,2015/12/29 15:18:32,0,1,41237,8080,0,0,0x0,tcp,deny,60,60,0,1,2015/12/29 15:16:06,0,any,0,7857899777,0x8000000000000000,china,UK,0,1,0,policy-deny
0 Karma

jkat54
SplunkTrust
SplunkTrust

With join:
index=antivirus | eval src_ip=dest_ip | join src_ip [ search index=firewall ]

With map:
index=antivirus dest_ip=* | map [ search index=firewall src_ip=$dest_ip$]

0 Karma

sundareshr
Legend

If I am reading this right, you are looking to find events if the host field in the av logs and source field in the firewall logs are the same. Is that right? Have you tried something like this

index=* (sourcetype=antivirus OR sourcetype=firewall) | eval ip=if(sourcetype=antivirus, host, source) | ...

This will give you a common field between the two to analyze.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...