I'm noodling the thought of using Splunk to detect Web attacks (similarly to Scalp) via the Apache HTTP logs. Scalp uses the PHP-IDS ruleset to find potential attacks. This ruleset is a series of regex strings used to search the Apache logs. I cannot link the file, but I suspect simply searching on phpidsrules.xml or default_filter.xml should turn up the file and the included regex strings. However, I'm having some difficulties using the regex strings provided in the xml file to search the logs. I'm assuming that this is a difference between how Splunk handles regex an how php does. Here is one example of a search that I'm attempting to use from the phpids rules: sourcetype=access_combined_wcookie | regex _raw="(?:"[^"]*[^-]?>)|(?:[^\w\s]\s*\/>)|(?:>")" This search produces the error: Error in 'SearchParser': Missing a search command before '^'. Error at position '61' of search query 'search sourcetype=access_combined_wcookie | regex ...{snipped} {errorcontext = raw="(?:"[^"]*[^-]?>)}'. ... View more

According to the Splunk documentation some sourcetypes will be automatically recognized. This includes linux_secure. However, in my environment none of the fields are recognized. It is normal that pretrained sourcetypes wouldn't have any field extraction established? I'm willing to do the field extraction myself if this is normal. However, I suspect that maybe something is broken and the field extraction should already be done for known / pretrained sourcetypes (like linux_secure). http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Listofpretrainedsourcetypes ... View more