Hi there,
i'm somewhat new to splunk and hoping some of the more seasoned veterans can assist me.
I have a process hashing a file and writing some output to a log.
the entries look like this:
Wed 11/21/201215:17:54.38 //// File Checksum Integrity Verifier version 2.05.//31127455faac11149dfdabc2261cdb7a c:\integrity\integrityservicex.exe
host=WIN-IK3D6F4B55R Options| sourcetype=integrity-too_small Options|
source=C:\Program Files\SplunkUniversalForwarder\integrity.txt Options
it is being indexed and is searchable properly.
what I wanted to to was create an alert for when the hash entry changes, in this case the hash is :31127455faac11149dfdabc2261cdb7a
so I would always expect the valid entry to exist in the file, what I want to do is detect an invalid entry (the hash has changed) and alert based on that.
Could anyone offer a few hints to get me started?
A method will be to use a field extraction to get the value of the hash from each event.
Then pick a timerange and get the first and last hash of the events and add some logic.
Finally setup an alert on the number of results > 0
<mysearch>
| rex "version \d+\.\d+.(|\d+)//(?<hash>[\w\d]*)"
| stats latest(_time) as _time latest(hash) AS newhash earliest(hash) AS oldhash
| WHERE NOT newhash=oldhash
| table _time newhash