About JPaule

JPaule · ‎05-09-2019

Could someone help me on this regex? I only want the first part of the data up to "AWSLogs". Example Below: s3://this-is-bucket-name/test/AWSLogs/123457276024/Config/us-gov-west-1/2019/5/6/ConfigHistory/123457276024_Config_us-gov-west-1_ConfigHistory_AWS::EC2::VPC_20190506T182522Z_20190506T182912Z_1.json.gz I only need: s3://this-is-bucket-name/test/AWSLogs

JPaule · ‎03-06-2019

index=x IP=10.196.xx.xx | table * Where IP is column name. That should work unless I'm missing something.

JPaule · ‎03-06-2019

search for errors here | join key [inputlookup error_lookup] | table *

JPaule · ‎03-06-2019

first search here | join key [inputlookup identity_lookup] | table *

JPaule · ‎03-05-2019

Nick, thanks for your detailed reply. What are some of the things you are monitoring? Here is a short list of what I was able to find/monitor in Splunk, but I feel like I couldn't find some items in Splunk I needed to monitor (i.e. Seeing if all s3 buckets were encrypted): Ensure ingress traffic isn't open to All Ensure EBS, RDS encryption Monitor changes in Bucket Policy, Sec Groups, NACL AMI versions up to date Monitor root access, MFA is used, etc OS level monitoring (patches,etc) Anti Virus monitoring Looking further into CloudTrail logs - figuring out what's important and how to display it I've also referenced the following but some of the items are best practices VS monitoring: https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf

JPaule · ‎03-04-2019

Anyone primarily using Splunk to monitor AWS from a security perspective? If so, how are you doing it? Splunk Enterprise Security? Splunk AWS app? Splunk Security Essentials App? Splunk Enterprise - Custom dashboards/reports? Other add-on's/Apps? Other outside tools? Is Splunk alone enough? Please let me know what you’re using and if you could go into detail that would be awesome!

JPaule · ‎02-27-2019

Sorry, one last question. How do I associate port cidr with account_id? When I table it account_id is blank.

JPaule · ‎02-27-2019

Awesome, this was a huge help!

JPaule · ‎02-26-2019

I replied below, but shows up as an answer. I'm somewhat new to using this forum!

JPaule · ‎02-26-2019

Frank - Arg, sorry I didn't give you the _raw log. Here is the _raw log below, would what you gave me work for the _raw log? Attached is an image of the _raw log tabled out which is what I gave you in the first post. (I manually changed the data (i.e. IP's, acct #'s, etc, to hide secure info) {"account_id": "2345625234", "vpc_id": "vpc-xxxxxx", "id": "sg-xxxxxx", "rules": [{"from_port": null, "groups": "\n ", "to_port": null, "grants": [{"owner_id": "323256661429", "group_id": "sg-xxxxx", "cidr_ip": null, "name": null}, {"owner_id": "253452345", "group_id": "sg-xxxxxx", "cidr_ip": null, "name": null}], "ipRanges": "", "ip_protocol": "-1"}, {"from_port": "22", "groups": "", "to_port": "22", "grants": [{"owner_id": null, "group_id": null, "cidr_ip": "11.233.34.0/24", "name": null}], "ipRanges": "\n ", "ip_protocol": "tcp"}, {"from_port": "443", "groups": "\n ", "to_port": "443", "grants": [{"owner_id": "2345432223", "group_id": "sg-770f1213", "cidr_ip": null, "name": null}, {"owner_id": null, "group_id": null, "cidr_ip": "12.45.50.0/24", "name": null}, {"owner_id": null, "group_id": null, "cidr_ip": "0.0.0.0/0", "name": null}], "ipRanges": "\n ", "ip_protocol": "tcp"}], "tags": {"aws:cloudformation:stack-id": "arn:aws-us:cloudformation:xxxx", "aws:cloudformation:stack-name": "xxx", "aws:cloudformation:logical-xx": "rSecurityGroup"}, "instances": [{"id": "i-0fqjwoi34f"}], "name": "SG-seccenter", "rules_egress": [{"from_port": null, "groups": "", "to_port": null, "grants": [{"owner_id": null, "group_id": null, "cidr_ip": "0.0.0.0/0", "name": null}], "ipRanges": "\n ", "ip_protocol": "-1"}], "region": "us-gov-west-1", "owner_id": "3234635623", "description": "SG for seccenter"}

JPaule · ‎02-25-2019

I'm trying to query for which ports are open on IP ranges, although the data has multiline information. Below is an example of one event. So if I wanted to query what is open to 0.0.0.0/0, right now my query returns 22, 443, 1515 because of how the event is structured. How can I break up this event so I get the correct result that 22 is the only one open to 0.0.0.0/0. Also, how can I show 443 has the 2 IP's open 11.11.55.0/24 and 12.35.12.0/26? (Goes without saying but the data/IP's below are made up) Acct Port CIDR 77812 22 0.0.0.0/0 443 11.11.55.0/24 12.35.12.0/26 1515 11.0.0.0/10

JPaule · ‎07-13-2018

Do you mean use UF to get WMI data? I need WMI because it's the only way to get a certain type of data. I'm trying to pull in data for windows service accounts that are running services across all 200 of my servers.

JPaule · ‎07-12-2018

What further configuration is needed to pull WMI logs from remote servers, currently we are only getting back data from the local host? Followed this documentation and ensured permissions were correct, to no avail: http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/MonitorWMIdata

JPaule · ‎07-25-2017

I'm having issues creating an alert that looks at lets say 100 different hosts, but I need to get an alert if one or more host is at 95% CPU usage for a span of 10 min. Here is what I have so far but it doesn't seem to work because for example if 3 hosts are over 95% for let's say 4min each, I get an alert. Although, I only need the alert if 1 server is over 98% for 10 min: index=xxx counter="% Processor Time" sourcetype="perfmon:processor" Value > 95 | timechart span=10m eval(round(avg(Value),1)) by host useother=f I found a couple similar posts on this question, but none of the proposed solutions worked.

JPaule · ‎11-02-2016

We have hundreds of reports (saved searches) which all show up when you click on the Reports tab. How can you better organize reports so they are easily findable by category, similar to how the filters at the top work for "All", "Yours", and "This App's". Is there any way to add a tagging column to filter by the tag? So, the types of filters for example could be: IIS, Audit, SQL, Windows, ULS, etc. Then when the respective tag is selected only those reports would show up. Any help would be great, I've done a fair share of Googling and couldn't find anything except creating new dropdowns at the top, but that seems inefficient especially when new reports are created.

JPaule · ‎09-27-2016

I have the following query to display top 10 counts, for example: sourcetype=IIS | top 10 URL This returns the total counts of URL hits and percentage of the top 10 URLs. How can I show the unique/distinct counts in the column next to total counts?

Posts	16
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎09-27-2016

Online Status	Offline
Date Last Visited	‎10-01-2024 10:35 AM

Regex help

Splunk AWS Security

Break up multi line event

WMI Splunk pull remote logs

Create an alert based on CPU being at 95% for a sp...

How can I organize reports better for improved vis...

How to develop a table that displays top 10 counts...

Regex help

Re: Need to search all request based on IP address

Re: Error search

Re: | search the list in inputlookup in another qu...

Re: Splunk AWS Security

Splunk AWS Security

Re: Break up multi line event

Re: Break up multi line event

Re: Break up multi line event

Re: Break up multi line event

Break up multi line event

Re: WMI Splunk pull remote logs

WMI Splunk pull remote logs

Create an alert based on CPU being at 95% for a sp...

How can I organize reports better for improved vis...

How to develop a table that displays top 10 counts...

Are you a member of the Splunk Community?