Hi, I'm trying to add an additional condition to this rule. Currently it splits up the raw value from our web logs trying to find SQL injection, although I want to lower the number of commands it needs to alert, but add a count to where the src ip is greater than 5. And I can't seem to make it work. The command below is what I currently have already: index=foo NOT src="10.0.0.0/8" NOT src="172.16.0.0/12" NOT src="192.168.0.0/16" | eval num_sql_cmds=mvcount(split(_raw, "alter%20table")) + mvcount(split(_raw, "between")) + mvcount(split(_raw, "create%20table")) + mvcount(split(_raw, "create%20database")) + mvcount(split(_raw, "create%20index")) + mvcount(split(_raw, "create%20view")) + mvcount(split(_raw, "delete")) + mvcount(split(_raw, "drop%20database")) + mvcount(split(_raw, "drop%20index")) + mvcount(split(_raw, "drop%20table")) + mvcount(split(_raw, "exists")) + mvcount(split(_raw, "exec")) + mvcount(split(_raw, "group%20by")) + mvcount(split(_raw, "having")) + mvcount(split(_raw, "insert%20into")) + mvcount(split(_raw, "inner%20join")) + mvcount(split(_raw, "left%20join")) + mvcount(split(_raw, "right%20join")) + mvcount(split(_raw, "full%20join")) + mvcount(split(_raw, "select")) + mvcount(split(_raw, "distinct")) + mvcount(split(_raw, "select%20top")) + mvcount(split(_raw, "union")) + mvcount(split(_raw, "xp_cmdshell")) + mvcount(split(_raw, "1=1")) -25 | where num_sql_cmds >= 2 This is to eliminate if we see a single IP which hits on legitimate traffic. For example, the following uri will match the conditions but only had event in the logs, where an actual SQL injection would likely hit a number of times from the same IP. /Secure/Int/OnlineService/ReviewService/scripts/core/components/select-option/select-option.htm Any help would be appreciated. Thanks ... View more

Hi, I'm trying to make a whitelist for encoded commands which IT Support use and I'm having a problem getting an inputlookup to match against a particular entry in the csv. The query which I'm using is (index=wineventlog sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR tag=process) process=*powershell* (CommandLine="*-EncodedCommand*" OR CommandLine="*-enc*") | search NOT [| inputlookup CommandLine_whitelist.csv ] | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process, CommandLine And I'm trying to exclude this CommandLine (this is exactly how it appears in the logs): "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noninteractive -noprofile -encodedCommand RwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAKgAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAJABfAC4ARABpAHMAcABsAGEAeQBOAGEAbQBlAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAIAAtAGEAbgBkACAAJABfAC4AUABTAEMAaABpAGwAZABOAGEAbQBlAC4AbABlAG4AZwB0AGgAIAAtAGwAdAAgADMAOQAgAC0AYQBuAGQAIAAkAF8ALgBVAG4AaQBuAHMAdABhAGwAbABTAHQAcgBpAG4AZwAgAC0AbABpAGsAZQAgACIAKgBtAHMAaQBlAHgAZQBjACoAIgB9ACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIABEAGkAcwBwAGwAYQB5AE4AYQBtAGUALAAgAFAAUwBDAGgAaQBsAGQATgBhAG0AZQAsACAARABpAHMAcABsAGEAeQBWAGUAcgBzAGkAbwBuACwAIABJAG4AcwB0AGEAbABsAEQAYQB0AGUAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAEAAewBOAGEAbQBlAD0AJwBBAHAAcAAgAE4AYQBtAGUAJwA7AEUAeAA9AHsAJABfAC4ARABpAHMAcABsAGEAeQBOAGEAbQBlAH0AfQAsAGAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAQAB7AE4AYQBtAGUAPQAYIFAAcgBvAGQAdQBjAHQAIABDAG8AZABlABggOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewAkAF8ALgBQAFMAQwBoAGkAbABkAE4AYQBtAGUAfQB9ACwAYAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABAAHsATgBhAG0AZQA9ABggVgBlAHIAcwBpAG8AbgAZIDsARQB4AHAAcgBlAHMAcwBpAG8AbgA9AHsAJABfAC4ARABpAHMAcABsAGEAeQBWAGUAcgBzAGkAbwBuAH0AfQAsAGAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAQAB7AE4AYQBtAGUAPQAYIEkAbgBzAHQAYQBsAGwAZQBkACAATwBuABkgOwBFAHgAcAByAGUAcwBzAGkAbwBuAD0AewAkAF8ALgBJAG4AcwB0AGEAbABsAEQAYQB0AGUAfQB9ACAAfAAgAFMAbwByAHQAIAAnAEEAcABwACAATgBhAG0AZQAnAA== -inputFormat xml -outputFormat xml We have other / longer commands which work without a problem, but for the life of me, I cannot get this to work. I'm guessing it has something to do with something in the encoded string which is breaking matching on it, but I don't know what it is, or how to fix it. Any help would be greatly appreciated. Thanks, Steve ... View more

Hi Everyone, I'm building / improving one of the alerts which we use to detect when a event log has been turned off from logging. index=wineventlog tag=Reboot OR tag=Clear | transaction endswith=tag=Clear startswith=tag=Reboot maxevents=2 maxspan=30m keeporphans=t | stats list(duration) as Duration by dest | mvexpand Duration | where Duration>300 The code above works great, although I'm struggling to finish it off. I'm trying to find if a log has been cleared without a corresponding reboot has taken place. I'm guessing that I need to use keeporphans, but I can't get it to be placed in the stats field for that specific event. Any help is appreciated. Thanks Steve ... View more