Concatenate events from FTP log to produce UserID list of successful logins

[bwhyle]

My goal is to create a search that produces a report of ftp users that have logged in (successfully) in the past 7 days. My issue is that each FTP command is a separate event and the common link is the session ID. I've created fields of each piece of information I need to evaluate (UserID, SessionID, ftpcommand) but I'm not sure how to pull them all together as one event using the sessionID to create the table of users with the last login timestamp. (I know the 230 after PASS indicates a successful login)

Sample log entries:
23:59:59 10.1.2.3 [805910]PASS - 230 0 0 0 1531
23:59:57 10.1.2.3 [805910]USER user123 331 0 0 0 0

create UserID Field
rex "(?i)^[^USER]*USER(?P.+?)\s+\d+"

create SessionID field
rex "(?i) (?P[\d+])C"

Create ftpcommand field
rex "(?i)^[^]]*](?P[^ ]+)"

Any feedback or direction is appreciated.

[MuS · Accepted solution]

Hi bwhyle,

based on your provided example you could use something like this:

your base search here 
| transaction "sessionid" startswith="USER" maxspan=1min
| stats last(_time) AS "last login time" by userid, ftpcommand, sessionid

the transaction will use the sessionid to build the events, the events will start at the USER and lasts for a maximum of 1 minute. The stats is used to do the output you want.
Adapt it to your needs and you're done.

Hope this helps ...

cheers, MuS

[ppablo]

Hi @bwhyle

Glad you got your issue solved! Please be sure to accept @MuS's answer by clicking on the check mark next to his response. People with similar issues will look to this post for help aand you both get karma points too 🙂

Patrick

[bwhyle]

Brilliant, thanks for your help!