Splunk Search
Highlighted

How to search for events of the same type in the same IP subnet?

Explorer

I am trying to detect a virus outbreak in our network. Just want to check if 3 or more hosts have the same virusname in a subnet usually the first 24 bits match

Fields available

VirusName=conficker
Host IP address=X.X.X.X

Tags (3)
0 Karma
Highlighted

Re: How to search for events of the same type in the same IP subnet?

SplunkTrust
SplunkTrust

Try something like this

your base search | rex field=HostIP "^(?<IPSubnet>\d+\.\d+\.\d+)" | stats dc(HostIP) as AffectedHostCount by VirusName,IPSubnet | where AffectedHostCount >=3
0 Karma
Highlighted

Re: How to search for events of the same type in the same IP subnet?

Explorer

thanks somesoni2 , can you have above search amended so it lists the events within the same hour and also shows computername

The field available are

virusname
hostip
computername

0 Karma
Highlighted

Re: How to search for events of the same type in the same IP subnet?

Explorer

please can you provide a update on this issue

0 Karma
Highlighted

Re: How to search for events of the same type in the same IP subnet?

Communicator

Lets say you have logs containing the virus name and the host IP address like:

VirusName=conficker HostIP=192.168.1.100 
VirusName=conficker HostIP=192.168.1.101 
VirusName=conficker HostIP=192.168.1.102 
VirusName=conficker HostIP=10.0.0.101 
VirusName=conficker HostIP=10.0.0.102

Try a search that generates a new field for the subnet, containing only the first three oktets, and then perform a stats count by subnet:

search | rex field=HostIP "(?<Subnet>.*)\." | stats count(VirusName) AS Count by Subnet | where Count > 3
0 Karma