Splunk Search

Alert if Fortigate and Clearpass events match

nielsg97
Engager

HI,

i've two datasources. Clearpass and Fortigate. I want to trigger an alarm if the Fortigate log contains Virus and Clearpass contains android. Is it possible in splunk to match those two based on src IP.

0 Karma
1 Solution

aakwah
Builder
(index=security sourcetype=fortigate) OR (index=security sourcetype=clearpass) 
| transaction src_ip keepevicted=true maxspan=30s
| search dvc=Android AND alert=virus 

View solution in original post

aakwah
Builder
(index=security sourcetype=fortigate) OR (index=security sourcetype=clearpass) 
| transaction src_ip keepevicted=true maxspan=30s
| search dvc=Android AND alert=virus 

nielsg97
Engager

Thanks helps a lot. but how to match src_ip if names are differtent in both events. in Fortigate its "src_ip" but in Clearpass its ip_address

0 Karma

aakwah
Builder

In similar use case, I created an alias for this field in props.conf under sourcetype stanza

[Clearpass sourcetype]

FIELDALIAS-ip_address =  ip_address as src_ip
0 Karma

splunker12er
Motivator

*|rename ip_address as src_ip |transaction.....

splunker12er
Motivator

try Fortinet FortiGate App for Splunk : link : https://splunkbase.splunk.com/app/2800/
add-on : https://splunkbase.splunk.com/app/2846/

docs: https://www.fortinet.com/content/dam/fortinet/assets/alliances/SolutionBrief-Fortinet-Splunk.pdf

The App can absorb a high volume of elevated logs in real time and provide insights to
examine advanced threat intent, widespread backdoor viruses, and unexpected information
flows in a single pane of glass, enabling quick visualization of everything that’s happening in
your datacenter and cloud.

clearpass splunk app link : https://splunkbase.splunk.com/app/1895/
Aruba ClearPass App for Splunk Enterprise

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...