How to search for the same IP in multiple sourcetypes within a certain time frame?

[janiceb]

Greetings,

I am looking for a way to search through 2 sourcetypes:

sourcetype=bro_http AND sourcetype=McAfee
to find any indications of a source IP on my network that shows up in those sourcetypes within a certain time frame, let's say an hour. They both have a common field name of src_ip.

The purpose is to attempt to try and detect a possible incident that may have occurred and see any correlation that may exist.

Any ideas would be appreciated.

Thanks,

Janice

[twinspop · Accepted solution]

After posting above, I think I realized what you want: Has an IP showed up in both sourcetypes within an hour of each other. I think something like this will work:

sourcetype=bro_http OR sourcetype=McAfee| 
bucket _time span=1m | 
stats count by src_ip sourcetype _time | sort _time |
streamstats current=f last(_time) as prev_time, last(sourcetype) as prev_sourcetype by src_ip | 
where prev_sourcetype!=sourcetype and _time-prev_time<3600 | 
eval prev_time=strftime(prev_time,"%Y-%m-%d %T")

[janiceb]

Thanks so much for your help. All of the searches worked, but this one gave me the best view of what I was trying to accomplish. I will try to build upon it from there to include other sourcetypes.

[muebel]

Hi janiceb,

This search will give you all related events for src_ip values that appear in both sourcetypes given a particular search time range:

src_ip=* sourcetype=bro_http OR sourcetype=McAfee | eventstats dc(sourcetype) AS sourcetype_count by src_ip | where sourcetype_count > 1

Please let me know if this answers your question!

[janiceb]

Thanks for your assistance. I wasn't able to get this to work for me.

[sundareshr]

Try this

index=* sourcetype=bro_http OR sourcetype=McAfee src_ip=* | chart count over src_ip by sourcetype | where bro_http>0 AND McAfee>0

[janiceb]

Hi Sundareshr. Thanks for your help. This search worked.

[twinspop]

sourcetype=bro_http OR sourcetype=McAfee | 
chart count over src_ip by sourcetype | 
where McAfee>0 and bro_http>0