correlating of events

[ayu15]

I want to correlate the login events of aws console to login events of cyberark.

people login to aws console via cyberark.

so need to correlate the login events of aws with cyberark, that if people are login to aws are they logining through cyberark or not.

[gcusello]

Hi @ayu15 ,

to correlate two different sources you have to find one or more correlation key: a transaction_id should be the best otherwise you can use username or other fields.

You have two methods to do this:

• you can use transaction that's easier but slower and you have the limit of 50,000 results in subsearch,
• you can use stats that's less easy but quicker.

e.g. having:

• index=cyberark, username called username,
• index=aws_console, username called user (this is an example to display different field names),
• using username as key.

In the first case, you you have to create something like this:

index=aws_console
| rename user AS username
| transaction username [ search index=cyberark ]
| table _time username ...

 in the second case, you you have to create something like this:

index=aws_console OR index=cyberark
| rename user AS username
| stats values(*) AS * earliest(_time) AS _time BY username
| table _time username ...

In my opinion, use always the second!

Ciao.

Giuseppe

[ayu15]

Hi @gcusello 

Thanks lot for the help but I am still not able to get the desired results.

please help to elaborate.

[gcusello · Accepted solution]

Hi @ayu15 ,

without any information is difficoult to help you, I gave you two methods to build you correlation.

But using the same Hypothesis of the above answer, adding only the conditions:

• action=login (for aws_console),
• message="Login successful" (for cyberark),

you could try:

(index=aws_console action=login) OR (index=cyberark message="Login successful")
| rename user AS username
| stats values(index) AS index dc(index) AS dc_index earliest(_time) AS _time BY username
| where dc_index=1 AND index=aws_console 
| table _time username

In this way you have the login events in aws_console with none login event in cyberark.

Ciao.

Giuseppe