Splunk Search

Alert if Fortigate and Clearpass events match

Engager

HI,

i've two datasources. Clearpass and Fortigate. I want to trigger an alarm if the Fortigate log contains Virus and Clearpass contains android. Is it possible in splunk to match those two based on src IP.

0 Karma
1 Solution

Builder
(index=security sourcetype=fortigate) OR (index=security sourcetype=clearpass) 
| transaction src_ip keepevicted=true maxspan=30s
| search dvc=Android AND alert=virus 

View solution in original post

Builder
(index=security sourcetype=fortigate) OR (index=security sourcetype=clearpass) 
| transaction src_ip keepevicted=true maxspan=30s
| search dvc=Android AND alert=virus 

View solution in original post

Engager

Thanks helps a lot. but how to match srcip if names are differtent in both events. in Fortigate its "srcip" but in Clearpass its ip_address

0 Karma

Builder

In similar use case, I created an alias for this field in props.conf under sourcetype stanza

[Clearpass sourcetype]

FIELDALIAS-ip_address =  ip_address as src_ip
0 Karma

Motivator

*|rename ipaddress as srcip |transaction.....

Motivator

try Fortinet FortiGate App for Splunk : link : https://splunkbase.splunk.com/app/2800/
add-on : https://splunkbase.splunk.com/app/2846/

docs: https://www.fortinet.com/content/dam/fortinet/assets/alliances/SolutionBrief-Fortinet-Splunk.pdf

The App can absorb a high volume of elevated logs in real time and provide insights to
examine advanced threat intent, widespread backdoor viruses, and unexpected information
flows in a single pane of glass, enabling quick visualization of everything that’s happening in
your datacenter and cloud.

clearpass splunk app link : https://splunkbase.splunk.com/app/1895/
Aruba ClearPass App for Splunk Enterprise

0 Karma