Multiple Firewall Denies followed by an allow from the same source IP

[bhymel5]

I'm looking for a way to create a splunk query (and then into a real time alert) when the below conditions are met.

Excessive firewall denies (say anything more than 50) followed by a firewall accept all from the same source IP within a 10 minute period.

Any ideas? I've tried multiple times to craft a query using transactions, but nothing I came up with worked.

[esix_splunk]

Based on the Cisco ASA TA, and eventgen, you could start here as a base:

index=test sourcetype="cisco:asa" ( action=blocked OR action=allowed ) | transaction dest  maxspan=10  startswith="action=allowed" endswith="action=blocked" | stats count by dest | where count > 50

A few things to note, you want to reverse dest to src and the startswith and endswith. (I was limited by what eventgen is generating.) And of course update your index and sourcetypes...

It's also worth noting that firewall logs are generally extremely high velocity. Meaning, that these usually are millions of events per minute. This means transaction over 10 minutes is extremely inefficient and will take a long time. There are probably better approaches to this, such as doing a reducing search with stats, and dumping that to a summary index, and then run the transaction against that summarized data.

[sumit29]

Same i am also looking for , Dear Experts kindly help 🙂