Scenario: I have 10 machines infected with malware. The believed infection source is email, I am attempting to create a search to find if any emails with the same subject line or sender have been sent to all 10 individuals.
Basis of search is below, I am just wondering what operator would be used to compare a field to itself and only return the results which are present in the logs of all users .
index=email sourcetype=email
recipient= user1 OR recipient=user2 OR recipient=user3 AND subject="unknown subject that is the same for all recipients"
Use the stats command to group events by subject then use where to show only those common to all 10 recipients.
index=email sourcetype=email
(recipient= user1 OR recipient=user2 OR recipient=user3) AND subject=*
| stats dc(recipient) as recipCount by subject
| where recipCount=10
Thanks guys, dc worked just as it should have.
Use the stats command to group events by subject then use where to show only those common to all 10 recipients.
index=email sourcetype=email
(recipient= user1 OR recipient=user2 OR recipient=user3) AND subject=*
| stats dc(recipient) as recipCount by subject
| where recipCount=10
Hi @pcyr,
Use dc OR distinct_count with stats to count distinct values of field recipient.
index=email sourcetype=email recipient IN (user1,user2,user3,user4,...,user10) subject="unknown subject that is the same for all recipients"
| stats dc(recipient) as count
| where count=10