My goal is to create a search that produces a report of ftp users that have logged in (successfully) in the past 7 days. My issue is that each FTP command is a separate event and the common link is the session ID. I've created fields of each piece of information I need to evaluate (UserID, SessionID, ftpcommand) but I'm not sure how to pull them all together as one event using the sessionID to create the table of users with the last login timestamp. (I know the 230 after PASS indicates a successful login)
Sample log entries:
23:59:59 10.1.2.3 [805910]PASS - 230 0 0 0 1531
23:59:57 10.1.2.3 [805910]USER user123 331 0 0 0 0
create UserID Field
rex "(?i)^[^USER]*USER(?P .+?)\s+\d+"
create SessionID field
rex "(?i) (?P [\d+])C"
Create ftpcommand field
rex "(?i)^[^]]*](?P [^ ]+)"
Any feedback or direction is appreciated.
... View more
