Hi Team
I am trying to find out recent CVE-2021-44228( log4j)
I tried " index=aws *log4j*", nut not sure how to find out and create an alert based on this Vulnerability.
Can anyone help me with the correct search and explain how to create an alert based on this vulnerability
Thanks
Hi
Yes, i tried the page, but the search is not working for me
Could you please me to understand why its not working
What are you trying to do?
Are you trying to locate the vulnerability within your infrastructure? You can't do that with splunk alone.
Or are you trying to see if someone already attempted to exploit it? In this case you simply might not have recorded any exploitation attempts.
Hi
yes i am trying to find out list out servers affected with this vulnerability and what to find out is there any new attempt was initiated with the user agent.
Thanks
OK. To find which of your servers are vulnerable (use the vulnerable library) you need a completely different tool - some form of software inventory solution and/or vulnerability scanner/manager.
To find out whether someone already tried to exploit this CVE, you have a nice splunk blog post https://www.splunk.com/en_us/blog/security/log4shell-detecting-log4j-vulnerability-cve-2021-44228-co...