Show changed events- What is the right approach to find the block events?

[dennis_u]

Say, we have events like this:

_time	fw	src_ip	dest_ip	dest_port	fw_rule_action
8/1/22 1:30:00.000 AM	fw1	192.168.50.51	8.8.8.8	53	block
1/1/22 1:30:00.000 AM	fw1	192.168.50.51	8.8.8.8	53	permit
12/31/21 1:30:00.000 AM	fw1	192.168.50.51	8.8.8.8	53	permit

We want to find the events that changed based on fw_rule_action. The real world scenario can be that you consolidated the (whatever) rule base and after application, you want to see, if some events are permitted that were blocked in the past and vice visa.

What is the right approach to find the (in this example) block events? Is creating a baseline the right way?

[FelixLeh]

If you want to make a check against recent data then the answer of @gcusello will work.

If you want to have a solution based on states (independently of time ranges) to check if the action changed then you could create a KVStore that stores the last/wanted state of the fw_rule_action.

To do so you have to create a KVStore with all the fields you need (in this case: src_ip,dest_ip,dest_port,fw,fw_rule_action)
You save the "correct" state of fw_rule_action with the combination of fields in the KVStore. Now if new events with the same combination of values appear you can check against the KVStore what the fw_rule_action was and if it matches the one from the live data. If it does you can ignore it, if it doesn't you can act on it.

I hope this helps! 🙂

_______________________________________

If this was helpful please consider awarding Karma. Thx!

[gcusello]

Hi @dennis_u,

you should run something like this:

index=your_index
| stats 
   earliest(_time) AS earliest 
   latest(_time) AS latest
   dc(fw_rule_action) AS fw_rule_actio_count
   values(fw_rule_action) AS fw_rule_action
   BY fw src_ip dest_ip dest_port
| where fw_rule_actio_count>1

in this way you have eventual multiple rule_actions for each group fw, src_ip dest_ip dest_port

Ciao.

Giuseppe