Splunk Search

Query Correlation

cesaralzaga
Engager

I was hoping that someone could help me out with a query. I am trying to correlate a DNS request to the firewall IP that was being forward. The firewall shows only the IP related to a rule that fired and I am trying to create a query that will capture the domain name query (DNS) that was associated with the rule(FIREWALL).

I have sourcetype=named query from IP: 72.9.231.10 Port:3391 Name: Paimia.com Destination: 141.101.116.157
sourectype=snort_alerts Blackhole_toolkit 141.101.116.157

I want to build a guery which will show all events from the souretype=snort Blackhole_tookit rule and destination IPs in common with destination IPs in the sourcetype=named.

Tags (1)
0 Karma

kml_uvce
Builder

with your less information ,i built below query... here its give output from both sourcetypes and common ip.

sourcetype=snort_alerts "Blackhole_toolkit" |join ip [search sourcetype=named]

kamal singh bisht

kml_uvce
Builder

Please vote or accept this as ans

kamal singh bisht
0 Karma

cesaralzaga
Engager

Thanks for Your help. It was spot on.

kristian_kolb
Ultra Champion

without posting any sample events, it's going to be hard for anybody to help you.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...