How create a search that should map a session from an internal application to the corresponding VPN session?

[alexandrucrc]

Hey guys,

I`m trying to create a search that should map a session from an internal application to the corresponding VPN session.

Main search - fields: IP_ADDRESS, USER_AD, _time - internal application login sessions.

Sub search - fields: Framed_IP_Address, User_Name, _time - VPN allocating internal IP.

My goal is to check whether users are using their AD account to log into application or not.

The problem right now is that field USER_AD is not displayed in the table and I was wondering why it is happening and how could I remediate that.

index=tkrsec sourcetype="cisco:acs" Acct_Status_Type=Interim-Update earliest=-8h latest=-1m
[ search index=tkrsec host=Hercules_fusion
| rename IP_ADDRESS as Framed_IP_Address
| table Framed_IP_Address ]
| eval time1=strftime(_time, "%m/%d/%y %I:%M:%S:%p")
| table User_Name,Acct_Status_Type,Framed_IP_Address,time1
| join type=outer USER_AD
[ search index=tkrsec host=Hercules_fusion
| eval time2=strftime(_time, "%m/%d/%y %I:%M:%S:%p")
| table time2,USER_AD ]
| table User_Name,Acct_Status_Type,Framed_IP_Address,time1, USER_AD, time2

[ITWhisperer]

USER_AD is not listed in the first table command so is not available for the subsequence join.

[alexandrucrc]

I did what you`re suggesting but it did not work that is how I ended using join command. Do you have any idea how to add that field to the table and actually be displayed in the table.

[ITWhisperer]

Perhaps if you share some anonymised events from your searches we might be able to understand what it is you are trying to deal with; working from your searches without a view of the data is like working with one hand tied behind your back! 😁