About zpadams - Splunk Community

Topics I've Started

Subject

Karma

Author

Latest Post

Correlation Search does not fire an email or notab...

0

by

I was asked by a co-worker to set the correlation search to look at the last 24 hours, but set the inline search to limit the results from the last 10 minutes. I used the "minutesago" and "earliest" time variables, and neither worked.

I would consider using a correlation search to achieve this. From the home page go to Configure > Content Management. Click "Create New Content" and select "Correlation Search". Name it however you want, and paste the dashboard search into the "Search" box. Set your time window you want the search to look through. Set the Cron Schedule to run every X minutes/hours, where X is the length of the time window. Set your Trigger Condition to be whatever your threshold is. Go to the bottom and click "+ Add New Response Action" and select "Send email". Enter your email address and make sure you select "Attach PDF" at the bottom of the gray box. This will now send an email with the PDF attached containing the search results every X minutes/hours whenever the threshold is breached.

I have this correction search we use to help detect common potential web attacks in IIS logs. The problem is that while the correlation is enabled, it does not fire off when a matching result is found. When we run the same search in a Search window for the same time frame, results are found that the correlation search missed. I cannot figure out why the Correlation Search does not fire. This is the configuration of the correlation search we are running: | tstats summariesonly=t count from datamodel=Web by _time, host, Web.uri_path, Web.uri_query, Web.http_user_agent, Web.src, Web.status | rename "Web.*" as * | makemv delim=";" attack_type | eval attack_type=(if(match(uri_path, "(?i)(javascript|vbscript|script|expression|applet|eval|phpinfo|iframe|frame|frameset)(?![a-z0-9\.]|$)"), mvappend(attack_type, "Script Inject"), attack_type)) | eval attack_type=(if(match(uri_query, "(?i)(javascript|vbscript|script|expression|applet|eval|phpinfo|iframe|frame|frameset)(?![a-z0-9\.]|$)"), mvappend(attack_type, "Script Inject"), attack_type)) | eval attack_type=(if(match(uri_query, "(?i)(select|union|insert|exec|replace|truncate)(?![a-z0-9]|$)"), mvappend(attack_type, "SQLi"), attack_type)) | eval attack_type=(if(match(uri_query, "(?i).*[^a-z]xp_.*"), mvappend(attack_type, "XP Call"), attack_type)) | eval attack_type=(if(match(uri_query, "(?i).*((\%3c)|<)((\%2f)|\/)*[a-z0-9\%]+((\%3e)|>).*"), mvappend(attack_type, "XSS"), attack_type)) | eval attack_type=(if(match(uri_query, "(?i).*(\/|\\|%2f|%5c)((\.|%2e)(?!\w)).*"), mvappend(attack_type, "Dir Traverse"), attack_type)) | eval attack_type=(if(match(uri_path, "(?i).*(\/|\\|%2f|%5c)((\.|%2e)(?!\w)).*"), mvappend(attack_type, "Dir Traverse"), attack_type)) | eval attack_type=(if(match(http_user_agent, "(?i)^\(\)(\+|\s)"), mvappend(attack_type, "Shellshock"), attack_type)) | search attack_type=* NOT uri_query="*<br/>*" NOT http_user_agent="*bingbot*" NOT [| inputlookup Security_IPs.csv | table c_ip | rename c_ip as src] Earliest Time: 10m@m Latest Time: @m Cron Schedule: Run every 10 minutes Scheduling: Real-Time Schedule Window: 0 Schedule Priority: Default Trigger alert when: Number of results is greater than 0 An email and a notable is set to generate. The email is set to go to my corporate mailbox.