Splunk Search

How to search ASA Built/Allowed events and the following Teardown event with the same source and destination IP?

CYBR_AH
Explorer

Hi everyone,

I'm trying to think of a way where I can find a built/allowed ASA event and the following teardown event (with same source IP and destination IP). My end goal is to be able to find any events that may just have a built/allowed and is missing the teardown event. Any help would be awesome!

0 Karma
1 Solution

renjith_nair
Legend

If you just want to see the missing the teardown is to look for the events which has only starting part of event.

Try something like this

your search ( event="allowed" OR event="teardown") |stats first(event) as latest_event by ip,other fields | search latest_event="allowed"

Not sure how your events look like and their field names but try the above dummy search with your original fields. This will extract all the latest event per IP and then the events which has only starting but no ending

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

If you just want to see the missing the teardown is to look for the events which has only starting part of event.

Try something like this

your search ( event="allowed" OR event="teardown") |stats first(event) as latest_event by ip,other fields | search latest_event="allowed"

Not sure how your events look like and their field names but try the above dummy search with your original fields. This will extract all the latest event per IP and then the events which has only starting but no ending

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...