comparing values returned by two separate searches with a threshold

[akhan92394]

I have a search which looks for VA scanning activity from firewalls threat logs, I am attempting to have an alert trigger if activity is seen going back to the source IP. I was able to come up with something that appears to work. My logic would be that I want to then search the firewall traffic logs to see if any of the destination IP's match the source IP's from the previous search.

Would this be the most efficient way of going about this? Query Below.

index=X sourcetype="pan:threat" " (severity=critical OR severity=high OR severity=medium)
| stats dc(signature) as Attacks by src_ip
| where Attacks > 10
| fields src_ip | join src_ip [search index=X sourcetype="pan:traffic" | fields dest_ip] | where src_ip = dest_ip

[mayurr98 · Accepted solution]

hey you can try something like this

index=X sourcetype="pan:threat"  (severity=critical OR severity=high OR severity=medium) 
| stats dc(signature) as Attacks by src_ip 
| where Attacks > 10 
| table src_ip | join src_ip [search index=X sourcetype="pan:traffic" | dedup dest_ip | table dest_ip | rename dest_ip as src_ip]

let me know if this helps!

[akhan92394]

Thank you for the response,

Would you mind clarifying where the comparison is done in the query to check if the Dest IP matches the source IP's from the first search. Just trying to get a better understanding of your logic.

much appreciated.

[mayurr98]

so after join you are getting the only column which is src_ip which are actually dest_ip's which are matching src_ips.
so what I have done has I created a table of src_ip's having attacks>10. so you have a table which has src_ips.
then I created another table from sourcetype=pan:traffic. got a table of dest_ips .I renamed those ips as src_ip because I have to match this with the previous table so that is why join src_ip. so whatever output you are getting is basically matching ips between src_ip and dest_ip.

I hope you understand this

sorry for my english!

[akhan92394]

Understood perfectly. Thank you for you explanation. I appreciate it.