Splunk Search

search index for IP correlation

ldunzweiler
Engager

I am trying to do this logic. Each "IF" I can do separately no issue. However, I am not sure how to combine these two searches together as the second search is based off the output of the first.

IF we see more than 10 failed events (1201 OR 1203)

THEN IF we see more than 2 different users

    print ForwardedIP

    Pipe
        IF we see successful events (1200 OR 1202)

            Print Usernames

The searches basically consist of

index="auth" EventCode=1201 OR EventCode=1203 | rex "(?[^<]+)" | rex "(?[^<]+)" | stats values(UserId) as UserId by ForwardedIpAddress

And then EventCode 1200 and 1202 for successful auth.

If we see bad auths with multiple users from the same IP, and then we see a successful auth we want to know about it.

Tags (2)
0 Karma

woodcock
Esteemed Legend

Like this:

index="auth" AND (EventCode="1201" OR EventCode="1203" OR EventCode="1200" OR EventCode="1202")
| rex GarbledWhatever
| stats count(eval(EventCode="1201" OR EventCode="1203")) AS failed count(eval(EventCode="1200" OR EventCode="1202")) AS successful values(UserId) AS UserId dc(UserId) AS userCount BY ForwardedIpAddress
| where userCount>2 AND failed>10 AND successful>0
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try something like this

| stats count user_count by UserId, EventCode, ForwardedIpAddress
| eval NEW_FIELD=if(user_count>=2 AND (EventCode=1201 OR EventCode=1202),"Multiple users, same IP","Nothing to see here")
0 Karma

xavierashe
Contributor

Give map at try.

index="auth" EventCode=1201 OR EventCode=1203 | rex "(?[^\<]+)" | rex "(?[^\<]+)" | stats values(UserId) as UserId by ForwardedIpAddress | map search="search index=auth EventCode=1200 OR EventCode=1202 UserId=$UserId$"
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Not a good idea to use map here.. You're already filtering down the eventcode's in the base of the search and iterating against each user_id field. What happens if there's hundreds of thousands of users? This is going to crush performance and does not scale well. Better approach is to use stats and pre-process the data and feed that into a conditional statement

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>