Splunk Search

How to query for basic malware outbreak?

Deeksha
New Member

I need a query for basic malware outbreak

Deeksha_0-1671675972843.png

 

Need query with server IP and server name from this raw logs.

Labels (1)
0 Karma

yottanat2021
Explorer

you have to install ta-windows for extract fields and use field to query

search example:
index=* source="WinEventLog:Security" | table _time src src_ip dest action app signature

0 Karma

Deeksha
New Member

Thanks for your reply, but we are using Trend Micro Apex One as an antivirus and we are able to extracting from the same.

Could you please confirm that TA for Microsoft Windows Defender will support Trend Micro Apex One?

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...