Splunk Search

How to build a correlation search for direct web traffic without proxy?

SIEMStudent
Path Finder

Hi Splunkers, 

I'm facing the following task: I have to build a correlation search that check users that go on a web page without using proxy or, in other words, direct traffic that no pass throug it. 

The rule itself is not a problem; i could perform some checks, for example if the host is not a proxy. My question is: using Data Model Web, because one bound is to use DM if possible, how can I distinguish direct web traffic by proxy one? I mean, which field, or fields, am I supposed to check to identify direct traffic from proxy one using this DM? Is this action possible with Web DM?

 

Labels (2)
0 Karma
1 Solution

smurf
Communicator

Hi,

if you know that you can find it based on a host, you can use it in the data model too.

| tstats count from datamodel=Web where host=not_a_proxy

 

View solution in original post

smurf
Communicator

Hi,

if you know that you can find it based on a host, you can use it in the data model too.

| tstats count from datamodel=Web where host=not_a_proxy

 

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...