How to edit my search to do a correlation between two sourcetypes?

[kestasm]

Hello I am looking for a way to do a correlation and search between two sourcetypes. Here is what I came up with so far:

(sourcetype="sep:ids" AND signature="OS Attack: MSRPC Server Service RPC CVE-2008-4250 attack blocked") AND (sourcetype="sep:risk" AND signature="W32.Downadup.B") | table remote_host_ip, Computer_name

The goal is to filter all events from sep:ids sourcetype which corresponds to signature="OS Attack: MSRPC Server Service RPC CVE-2008-4250 attack blocked" indicating potential Conficker activity and then to double check that, I need to correlate those remote_host_ip values against the sep:risk sourcetype to make sure if those hosts were ever triggered by SEP with signature="W32.Downadup.B". I also need to output the remote_host_ip (from sep:ids) vs computer_name (from sep:risk) if there is a match.

[cpetterborg · Accepted solution]

If you have an AND between your two parenthesized conditions, you won't get any data. Putting an OR instead of the AND will catch both sourcetypes in your search. I'm not sure what method you are using to correlate the two, but I suppose you could use a transaction command if you have a field that you can use to correlate the data from both events, or by time. I'm not sure enough about your data to be able to give you more than than.

If I don't understand them problem and my suggestion is not relevant, please provide more information about your data and how you can correlate the data.