About alexrod03

alexrod03 · ‎01-22-2024

I need to look for an incoming email and if an email matches a certain subject, I need to check another source type to see if within an hour of that email coming through there was a hit on that sourcetype.

alexrod03 · ‎03-24-2020

So I have this query but it's not showing the hosts I know for a fact are only sending internal IP's. If I remove the other hosts and only keep the one that is sending internal IP's it works. Index=IIS (host=Host1 OR host=Host2 OR host=Host3 OR host=Host4 | eval theIP=if(isnull(Client_IP), c_ip, Client_IP) | eval isExternal=if(cidrmatch("192.0.0.0/8",theIP), "internal", "external") | stats count AS "Total" by isExternal, host | where isExternal="external" AND Total <0

alexrod03 · ‎03-23-2020

I think I may have figured it out. index=IIS (host=Host1 OR host=Host2 OR host=Host3 OR host=Host4) | eval theIP=if(isnull(Client_IP), c_ip, Client_IP) | eval isExternal=if(cidrmatch("192.0.0.0",theIP), "internal", "external") | stats count AS "Total" by isExternal, host | where isExternal="external" AND Total <30

alexrod03 · ‎03-23-2020

That worked no errors but no results. So basically I want know if one of those hosts is only sending 192.0.0.0/8 ip's under the c_ip and Client_IP field.

alexrod03 · ‎03-23-2020

Doing a range. Example 192.0.0.0/8

alexrod03 · ‎03-23-2020

I am getting an error. Error in 'eval' command:The number "range" is invalid

alexrod03 · ‎03-23-2020

Yes there is an internal range. So in essence c_ip=InternalRange OR Client_IP=InternalRange. But I want to alert when c_ip or Client_IP are ONLY sending internal range for 24 hour period. Normally c_ip and Client_IP send a mixture of and internal range and external IP's. Hopefully this makes sense.

alexrod03 · ‎03-23-2020

So these hosts send internal and external IP address in the c_ip and Client_IP field. Is there a way to filter out which hosts are only sending internal address for a 24 hour period?

alexrod03 · ‎03-23-2020

Hi @gcusello thanks for that. My end result would be to figure out which hosts are sending only internal address for a 24 hour period. These hosts send both internal and external address in the c_ip and Client_IP field.

alexrod03 · ‎03-23-2020

Hi, I am trying to bring back two interesting fields from multiple hosts. My search looks like this. index=IIS (host=Host1 OR host=Host2 OR host=Host3 OR host=Host4) c_ip=Range OR Client_IP=Range This search is only bringing back c_ip results not Client_IP results. It should be bringing back both.

alexrod03 · ‎02-24-2020

Is there a way to make an alert when a interesting field is no longer sending data?

alexrod03 · ‎10-15-2019

That worked great. Thanks

alexrod03 · ‎10-14-2019

I have one source type and 2 field values, username and IP. How do I show IP that is associated with multiple usernames.

Posts	13
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎10-14-2019

Online Status	Offline
Date Last Visited	‎01-22-2024 02:00 PM

How to combine two searches?

Multiple hosts with two interesting fields

Alert - Field no longer reporting data.

How to show an IP is associated with multiple user...

How to combine two searches?

Re: Multiple hosts with two interesting fields

Re: Multiple hosts with two interesting fields

Re: Multiple hosts with two interesting fields

Re: Multiple hosts with two interesting fields

Re: Multiple hosts with two interesting fields

Re: Multiple hosts with two interesting fields

Re: Multiple hosts with two interesting fields

Re: Multiple hosts with two interesting fields

Multiple hosts with two interesting fields

Alert - Field no longer reporting data.

Re: How to show an IP is associated with multiple ...

How to show an IP is associated with multiple user...

Join the Conversation