I am looking for a way to search through 2 sourcetypes:
to find any indications of a source IP on my network that shows up in those sourcetypes within a certain time frame, let's say an hour. They both have a common field name of src_ip.
The purpose is to attempt to try and detect a possible incident that may have occurred and see any correlation that may exist.
Any ideas would be appreciated.
sourcetype=bro_http OR sourcetype=McAfee | chart count over src_ip by sourcetype | where McAfee>0 and bro_http>0
index=* sourcetype=bro_http OR sourcetype=McAfee src_ip=* | chart count over src_ip by sourcetype | where bro_http>0 AND McAfee>0
This search will give you all related events for src_ip values that appear in both sourcetypes given a particular search time range:
src_ip=* sourcetype=bro_http OR sourcetype=McAfee | eventstats dc(sourcetype) AS sourcetype_count by src_ip | where sourcetype_count > 1
Please let me know if this answers your question!
After posting above, I think I realized what you want: Has an IP showed up in both sourcetypes within an hour of each other. I think something like this will work:
sourcetype=bro_http OR sourcetype=McAfee| bucket _time span=1m | stats count by src_ip sourcetype _time | sort _time | streamstats current=f last(_time) as prev_time, last(sourcetype) as prev_sourcetype by src_ip | where prev_sourcetype!=sourcetype and _time-prev_time<3600 | eval prev_time=strftime(prev_time,"%Y-%m-%d %T")
Thanks so much for your help. All of the searches worked, but this one gave me the best view of what I was trying to accomplish. I will try to build upon it from there to include other sourcetypes.