Search Help: Syslog and Matching Security Event Log

[kholleran]

Hello,

I am hoping to be able to right a search that does the following:

searches syslog data from a router. If criteria are met, look for login data on a specific server in a time window around the time of the syslog traffic.

We have some remote routers that are watched for SSL traffic. If criteria are met, I would like to get logins on a specific server (the only server with a route to these routers) for say, 10 minutes prior to the SSL Traffic. Not only am I not sure how to structure such a search, but the SSL traffic generates numerous syslog packets when hitting the router and I don't want to do the Securtiy Event Log lookup for each packet.

Thanks for any guidance.

Kevin

[lguinn2]

Try this. I didn't know much about what you were looking for, so you will need to insert your original search for syslog data where I have indicated <search for syslog data>. Ditto for the login search. Don't include the <>

<search for login data> [search <search for syslogdata> | stats latest(_time) as latestTime 
| eval earliest=relative_time(latestTime, "-5m") |  eval latest=relative_time(latestTIme, "+5m") | fields + earliest latest]

This technique uses a subsearch to look for the syslog data. If found, it extracts the most recent time from the results and calculates a time range that begins 5 minutes before that time and ends 5 minutes after that time. The time range is then returned to the outer search. This leverages the fact that earliest and latest are actually parameters that set the search time range.

Look at the docs about Subsearches for more info.