About janiceb

janiceb · ‎06-29-2016

Thanks Woodcock, for providing an answer. I am going to play around with this a bit more with real examples and see what happens.

janiceb · ‎06-28-2016

Hello All, I am going over one of the recipes in the online Splunk Book, pages 113 and 114. The example is solving the problem of using an explicit lookup and the eval coalesce command to provide a default field value if the event's value is not in the lookuptable. The example they provided is: .....| lookup mylookup ip | eval domain=coalesce(domain, "unknown") It is said that the mylookup file has two fields of "host" and "machine_type". I am assuming that the .... before the | lookup command should be the sourcetype that contains the events, for example, sourcetype=bro_http. Is this correct? I would like to know what the ip after the mylookup command is supposed to represent. Is this supposed to be a field name that exists in our event data, or is it supposed to be an actual IP since the example said that we are looking for an event's value? I would like to know where does the domain field name come from? Is this supposed to be a field name in the source event data? Thanks, Janice

janiceb · ‎04-19-2016

Thanks for your assistance. I wasn't able to get this to work for me.

janiceb · ‎04-19-2016

Hi Sundareshr. Thanks for your help. This search worked.

janiceb · ‎04-19-2016

Thanks so much for your help. All of the searches worked, but this one gave me the best view of what I was trying to accomplish. I will try to build upon it from there to include other sourcetypes.

janiceb · ‎04-19-2016

Greetings, I am looking for a way to search through 2 sourcetypes: sourcetype=bro_http AND sourcetype=McAfee to find any indications of a source IP on my network that shows up in those sourcetypes within a certain time frame, let's say an hour. They both have a common field name of src_ip. The purpose is to attempt to try and detect a possible incident that may have occurred and see any correlation that may exist. Any ideas would be appreciated. Thanks, Janice

janiceb · ‎04-08-2016

Thank so much for your answer. I have a better understanding. I really appreciate it.

janiceb · ‎04-08-2016

Good afternoon All, I am having a hard time trying to understand the difference between "lookup", "inputlookup", and "outputlookup". I am also trying to get a basic real world example of why one may use one over the other. I am assuming that you first have to create the actual lookup file, which I have done from a static csv file that contains some malicious domains. I called this file badfile.csv. My badfile.csv contains a field of "Domain" and let's say I am trying to search my "weblogs" sourcetype, and those logs also have the field name of "Domain". I know I need a common field in my lookup file that matches the sourcetype I am trying to search from, so a correlation can be made. I am trying to figure out if I could use the "inputlookup" command to search for any hits or if I need to use the "lookup" command, or if I need to use a combination of both. Also, how would the outlookup command play into this? I guess I am not sure what inputlook vs lookup does and am just looking for a more clear definition. Any information that anyone can provide to give a basic understanding to a beginner is much appreciated. Thanks

janiceb · ‎04-06-2016

Thanks so much! This works great!

janiceb · ‎04-06-2016

Greetings All, I am trying to use a static CSV file that contains bad domain indicators and search Splunk logs for any events where someone may have gone to that domain. The CSV file only contains one column with the heading of "Domain". How can I accomplish this in Splunk? I read about the inputlookup command, but this appears to be a way to add fields from the CSV file to my Splunk events. I am not looking to do this. I am just looking to have my results return any hits to those domains. I am using the WinDNS logs as my sourcetype and those logs also have a field in it called "Domain". Thanks, Janice

janiceb · ‎03-31-2016

I still didn't get it to work out for me. I entered the following, ran the test file and didn't get any alert. However, I just decided to use the basic transaction one that I initially made which will alert me if two of the requirements are met, but I will just have to follow up with additional analysis. Thanks for your help! LogType=Mylogs | streamstats current=t count(eval(BaseFileName="powershell.exe")) AS SessionID by host | sort host SessionID | stats values(*) AS * BY SessionID host | search CreatorProcessName="WINWORD" | search BaseFileName="cmd.exe"

janiceb · ‎03-31-2016

Thanks so much for your help!

janiceb · ‎03-30-2016

Thanks so much for your reply. I am not as familiar with the streamstats command so I will have to study it more. I am also not sure I explained things correctly. What I am trying to do is detect any hosts that may have been infected with PowerWare ransomeware. I know that this host activity may include opening a Word document, which has an embedded macro to execute the command prompt. After which, there are two instances of powershell that are executed. What I am trying to do is detect when a user opens a Word doc, gets a command prompt, and then two instances of powershell. I was able to come up with this: LogType=WindowsEventLog OR LogType=WLS | transaction host startswith=CreatorProcessName="WINWORD" endswith=BaseFileName="powershell.exe" However, the above doesn't specify the cmd.exe or the second instance of Powershell. If someone were to actually execute this PowerRare, I believe my alert will catch it, but it lacks the specification to include all of those events specifically. Thanks, Janice

janiceb · ‎03-30-2016

Good Morning, I am trying to create a transaction that will search my logs for hosts that perform the following: Start by opening a file(doc or pdf) Execute a command prompt perform action C perform action C again So far I have something like: LogType=Mylogs | transaction host startswith=CreatorProcessName="WINWORD" endswith=BaseFileName="chrome.exe" With the above command, I am about to see hosts that have opened a Word document and ended by opening a chrome browser, however, I am unable to see that the host met all 4 actions of (1) opening Word (2) opening a command prompt (3) opening a chrome browser (4) opening another chrome browser. How do I edit my search to also include the actions in between, number 2 and 3? Thanks

Posts	14
Solutions	0
Karma Given	0
Karma Received	7
Member Since	‎03-30-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Can someone help me understand the syntax and fiel...

How to search for the same IP in multiple sourcety...

What is the basic difference between the lookup, i...

How to search for events where someone visited a d...

Is there a way to create a transaction that contai...

Re: Can someone help me understand the syntax and ...

Can someone help me understand the syntax and fiel...

Re: How to search for the same IP in multiple sour...

Re: How to search for the same IP in multiple sour...

Re: How to search for the same IP in multiple sour...

How to search for the same IP in multiple sourcety...

Re: What is the basic difference between the looku...

What is the basic difference between the lookup, i...

Re: How to search for events where someone visited...

How to search for events where someone visited a d...

Re: Is there a way to create a transaction that co...

Re: Is there a way to create a transaction that co...

Re: Is there a way to create a transaction that co...

Is there a way to create a transaction that contai...