Splunk Search

Searching for Hash Values on the Network

Communicator

Hello All! 

    I have a .csv file that contains a list of about 100 or so hash values that I'd like to create an alert on so that I'll know if they appear on the network.  I have an inputlookup that I created called "hashes.csv" that contains the values I'd like to monitor.  Does anyone have SPL that I would need in order to do this?  Your help is very much appreciated!  Thanks.  

Labels (1)
0 Karma
1 Solution

Super Champion

All you'd really need to do is something similar to

|tstats count where index=<interesting_index> [|inputlookup hashes.csv|table <hash_field_name_in_index>] by index sourcetype

you could also do something like

index=<interesting_index> <filtering_data> [|inputlookup hashes.csv|table <hash_field_name_in_index>] | stats max(_time) as last_seen by index<hash_field_name_in_index>

there are honestly a handful of ways you could do this. depends on the input and the output, too. you can also join in the lookup file using | lookup instead of as a subsearch. 

View solution in original post

0 Karma

Super Champion

All you'd really need to do is something similar to

|tstats count where index=<interesting_index> [|inputlookup hashes.csv|table <hash_field_name_in_index>] by index sourcetype

you could also do something like

index=<interesting_index> <filtering_data> [|inputlookup hashes.csv|table <hash_field_name_in_index>] | stats max(_time) as last_seen by index<hash_field_name_in_index>

there are honestly a handful of ways you could do this. depends on the input and the output, too. you can also join in the lookup file using | lookup instead of as a subsearch. 

View solution in original post

0 Karma