Splunk Search

Splunk search to find out CVE-2021-44228(Apache Log4j Remote Code Execution)

jaibalaraman
Path Finder

Hi Team 

I am trying to find out recent CVE-2021-44228( log4j)

I tried " index=aws *log4j*", nut not sure how to find out and create an alert based on this Vulnerability. 

Can anyone help me with the correct search and explain how to create an alert based on this vulnerability

 

Thanks 

 

 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

jaibalaraman
Path Finder

Hi 

Yes, i tried the page, but the search is not working for me 

jaibalaraman_0-1639375938969.png

Could you please me to understand why its not working 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

What are you trying to do?

Are you trying to locate the vulnerability within your infrastructure? You can't do that with splunk alone.

Or are you trying to see if someone already attempted to exploit it? In this case you simply might not have recorded any exploitation attempts.

0 Karma

jaibalaraman
Path Finder

Hi 

yes i am trying to find out list out servers affected with this vulnerability and what to find out is there any new attempt was initiated with the user agent. 

 

Thanks

 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. To find which of your servers are vulnerable (use the vulnerable library) you need a completely different tool - some form of software inventory solution and/or vulnerability scanner/manager.

To find out whether someone already tried to exploit this CVE, you have a nice splunk blog post https://www.splunk.com/en_us/blog/security/log4shell-detecting-log4j-vulnerability-cve-2021-44228-co...

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...