Splunk Search

Help with tracking vulnerability data over time

responsys_cm
Builder

I'm trying to figure out the smartest way to track vulnerability data over time and account for how DHCP may mean that a single host is scanned at multiple IPs.

So, I've tried a search that looks for all vulnerability data and then it does an inner join by dest and _time on a subsearch that looks for a particular event ID that contains the hostname. I'm guessing I can them do a | streamstats max(_time) AS last_scan by dest | where _time=last_scan.

But for whatever reason, this search doesn't come back with any results:

index=vulnerabilities sourcetype=nessus NOT "Plugin ID,CVE," NOT dest=\*/* | join type=inner _time,dest [search index=vulnerabilities nessus_id="11936" OR nessus_id="12053" OR nessus_id="60035" NOT dest=\*/* | rex field=plugin_output "(?i)resolves\sas\s(?P<hostname>[^\.]+)\.(?P<domainname>\S+)?\." | eval hostname=if(isnull(hostname),dest,hostname) | fields hostname] | table _time,dest,hostname,signature_name 

What am I doing wrong here?

Tags (1)
0 Karma

woodcock
Esteemed Legend

One reason that it does not work (correctly) is that you cannot escape asterisks in SPL so this part is bad:

NOT dest=\*/*

You have to do something like this instead:

| regex dest!="\*/.*"
0 Karma

dolivasoh
Contributor

Try this. Any results?

index=vulnerabilities sourcetype=nessus | join type=inner _time,dest [search index=vulnerabilities | rex field=plugin_output "(?i)resolves\sas\s(?P<hostname>[^\.]+)\.(?P<domainname>\S+)?\." | eval hostname=if(isnull(hostname),dest,hostname) | fields hostname]
0 Karma

TimMc
Explorer

Not really sure about the index. Try breaking down the entire query and make sure that each part is working as expected.

0 Karma

responsys_cm
Builder

The parentheses didn't change anything...

0 Karma

TimMc
Explorer

Are parentheses required for your sub search to work?

[search index=vulnerabilities (nessus_id="11936" OR nessus_id="12053" OR nessus_id="60035") NOT dest=\*/*

Tim.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...