Splunk Search

How to query for basic malware outbreak?

Deeksha
New Member

I need a query for basic malware outbreak

Deeksha_0-1671675972843.png

 

Need query with server IP and server name from this raw logs.

Labels (1)
0 Karma

yottanat2021
Explorer

you have to install ta-windows for extract fields and use field to query

search example:
index=* source="WinEventLog:Security" | table _time src src_ip dest action app signature

0 Karma

Deeksha
New Member

Thanks for your reply, but we are using Trend Micro Apex One as an antivirus and we are able to extracting from the same.

Could you please confirm that TA for Microsoft Windows Defender will support Trend Micro Apex One?

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...