Splunk Search

Splunk search to find out CVE-2021-44228(Apache Log4j Remote Code Execution)

jaibalaraman
Path Finder

Hi Team 

I am trying to find out recent CVE-2021-44228( log4j)

I tried " index=aws *log4j*", nut not sure how to find out and create an alert based on this Vulnerability. 

Can anyone help me with the correct search and explain how to create an alert based on this vulnerability

 

Thanks 

 

 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

jaibalaraman
Path Finder

Hi 

Yes, i tried the page, but the search is not working for me 

jaibalaraman_0-1639375938969.png

Could you please me to understand why its not working 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

What are you trying to do?

Are you trying to locate the vulnerability within your infrastructure? You can't do that with splunk alone.

Or are you trying to see if someone already attempted to exploit it? In this case you simply might not have recorded any exploitation attempts.

0 Karma

jaibalaraman
Path Finder

Hi 

yes i am trying to find out list out servers affected with this vulnerability and what to find out is there any new attempt was initiated with the user agent. 

 

Thanks

 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. To find which of your servers are vulnerable (use the vulnerable library) you need a completely different tool - some form of software inventory solution and/or vulnerability scanner/manager.

To find out whether someone already tried to exploit this CVE, you have a nice splunk blog post https://www.splunk.com/en_us/blog/security/log4shell-detecting-log4j-vulnerability-cve-2021-44228-co...

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...