Monitoring Sync Status between MISP42 and ES instance

[noiiaz]

Hi guys,

I am looking to build a query/dashboard that would monitor the status of the connection of the splunk API to the MISP42 instance.

I am unsure how to go about this, I can't find anything interesting in _internal index to fetch or look at or a heartbeat that would indicate a successful handshake.

To my understanding, a search is ran every X days (we set it up once a day) to write the data we have in our MISP instance to lookups. Those different lookups are then used for Threat Intelligence and is mapped.

Maybe I should monitor the search to see if it did not write any updates? I am trying to get notified or a query that would let me know there is an issue with the feed.

Thanks,

[livehybrid · Accepted solution]

Hi @noiiaz 

You might be able to find the logs you are looking for in _audit, if you know the name of the search then try 

index=_audit savedsearch_name=<yourSearchName> info=completed action=search

Which should give you some more info about the search query, and useful info such as the number of events searches and results output (e.g. event_count=134, result_count=67)

Would this help provide the info you are looking for?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[noiiaz]

Hi @livehybrid,

I think that is a good place to start. I am going to tinker with that and report back. I have also challenged our success engineer at Splunk for any input, so I will report back with those findings too.

Have a great day!
Antoine

[livehybrid]

Excellent - post back here if you need any further help - I don't use the MISP app so not sure how it is expected to run but the _audit index should certainly give you some insight into those searches 🙂

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[noiiaz]

Hi @livehybrid,

I've come to find out that monitoring the search itself is all I was able to find in the logs. I cannot seem to find a trace of an API sync or an API pull. I'm sure it exists, but I can't find anything in the  _internal index related to it. Looking in there was also what was suggested by our technical representative.

I'll mark the monitor the sync as the solution as an alternative 🙂

Thanks!