Splunk Search

Is there a way to create a hyperlink in a stats table to an external site?

Sarmbrister
Path Finder

I am currently working on a Splunk query to look at Windows Defender data that has been allowed in the environment. I am using an evalto combine two fields which creates the URL to the Windows Defender Security Intelligence page. What I'd like to do is to make that result in the field a hyper link so all I have to do is click it and it directs me to the Windows Defender Security site. In my results example below I'd like to make the results in field windeflink a hyperlink.

My Search Query:
index=sccm sourcetype="sccm:malware" action=allowed
|stats count by dest_name,severity,signature
|eval windeflinkpart="https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name="
|eval windeflink=(windeflinkpart. "" .signature)
|table dest_name,severity,signature,count,windeflink
|sort severity

Results Example:
dest_name severity signature count windeflink
Severe 8 https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=

Tags (3)
0 Karma
1 Solution

niketnilay
Legend

@Sarmbrister, you can try the following run anywhere search. You would not need URL column in the Table. You can code table drilldown to add the signature token to the Custom URL. You can replace with your search.

  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval dest_name= "severe"
| eval severity=8
| eval signature="Ransom:PowerShell/Abpodul.A"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="signature">
            <link target="_blank">https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=$row.signature$</link>
          </condition>
          <condition>
            <!-- DO NOTHING ON OTHER COLUMNS-->
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

woodcock
Esteemed Legend

@sideview (the author of WorkFlow Actions) were just discussing the need for WorkFlow Actions on the Statistics tab.

0 Karma

niketnilay
Legend

@Sarmbrister, you can try the following run anywhere search. You would not need URL column in the Table. You can code table drilldown to add the signature token to the Custom URL. You can replace with your search.

  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval dest_name= "severe"
| eval severity=8
| eval signature="Ransom:PowerShell/Abpodul.A"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="signature">
            <link target="_blank">https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=$row.signature$</link>
          </condition>
          <condition>
            <!-- DO NOTHING ON OTHER COLUMNS-->
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Sarmbrister
Path Finder

This is great! Thank you @niketnilay.

0 Karma

niketnilay
Legend

Glad it worked 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma