Splunk Search

How to search for events of the same type in the same IP subnet?

shellnight
Explorer

I am trying to detect a virus outbreak in our network. Just want to check if 3 or more hosts have the same virusname in a subnet usually the first 24 bits match

Fields available

VirusName=conficker
Host IP address=X.X.X.X

Tags (3)
0 Karma

norbert_hamel
Communicator

Lets say you have logs containing the virus name and the host IP address like:

VirusName=conficker HostIP=192.168.1.100 
VirusName=conficker HostIP=192.168.1.101 
VirusName=conficker HostIP=192.168.1.102 
VirusName=conficker HostIP=10.0.0.101 
VirusName=conficker HostIP=10.0.0.102

Try a search that generates a new field for the subnet, containing only the first three oktets, and then perform a stats count by subnet:

search | rex field=HostIP "(?<Subnet>.*)\." | stats count(VirusName) AS Count by Subnet | where Count > 3
0 Karma

somesoni2
Revered Legend

Try something like this

your base search | rex field=HostIP "^(?<IPSubnet>\d+\.\d+\.\d+)" | stats dc(HostIP) as AffectedHostCount by VirusName,IPSubnet | where AffectedHostCount >=3
0 Karma

shellnight
Explorer

please can you provide a update on this issue

0 Karma

shellnight
Explorer

thanks somesoni2 , can you have above search amended so it lists the events within the same hour and also shows computername

The field available are

virusname
hostip
computername

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...