Splunk Search

How to generate a search to find persistent connections between client workstations to the internet?

Explorer

I have squid proxy log that I want to mine for persistent connections from my client workstations to the internet (ie: teamviewer, gotomypc, spyware C&C, etc).

Looking to do a search to determine if clients connect to the same URL or IP address during each 1 hour period of the prior 24 hours.

I have started with this search:

index=proxy | bucket _time span=1h | stats count by _time,user,url | sort - user

Which gives me a list of all urls by user by count, I think I need to then search this query for all occurrences by user by hour for each URL to determine if they are in all 24 hour periods.

Suggestions? Thoughts? Thanks

0 Karma

Esteemed Legend

You were so close; run your search for Last 24 hours and tack this onto the end of it:

| eventstats count(eval(count>0)) AS hours_non_zero BY user url | search hours_non_zero>=24
0 Karma

SplunkTrust
SplunkTrust

Give this a try. This will give your all users and hours and url for last 24 hrs where a user-url combination did not appear for all 24 hrs.

index=proxy  earliest=-24h@h latest=@h | bucket _time span=1h | stats count by _time,user,url  | eventstats dc(_time) as totalHours by user,url | where totalHours<24
0 Karma

Esteemed Legend

I think your < should be a =, right?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!