My goal is to create a search that produces a report of ftp users that have logged in (successfully) in the past 7 days. My issue is that each FTP command is a separate event and the common link is the session ID. I've created fields of each piece of information I need to evaluate (UserID, SessionID, ftpcommand) but I'm not sure how to pull them all together as one event using the sessionID to create the table of users with the last login timestamp. (I know the 230 after PASS indicates a successful login)
Sample log entries:
23:59:59 10.1.2.3 PASS - 230 0 0 0 1531
23:59:57 10.1.2.3 USER user123 331 0 0 0 0
create UserID Field
create SessionID field
rex "(?i) (?P
Create ftpcommand field
Any feedback or direction is appreciated.
based on your provided example you could use something like this:
your base search here | transaction "sessionid" startswith="USER" maxspan=1min | stats last(_time) AS "last login time" by userid, ftpcommand, sessionid
transaction will use the
sessionid to build the events, the events will start at the
USER and lasts for a maximum of 1 minute. The
stats is used to do the output you want.
Adapt it to your needs and you're done.
Hope this helps ...
Glad you got your issue solved! Please be sure to accept @MuS's answer by clicking on the check mark next to his response. People with similar issues will look to this post for help aand you both get karma points too 🙂