Hi folks,  I've been suffering from a creative crisis the last few days and looking for some brainstorming idea: I'm trying to come up with some use case ideas for SSO (particularly from Okta logs).  Does anyone have any examples on how to leverage the logs and what can I do with them in terms of any reports and alerts? All suggestions are more than welcome!  ... View more

Hi folks, Hoping you might be able to help. I've some raw logs coming in and one of the "extracted" fields is a fields with all the system information I need e.g. Remote Desktop Protocol: OS: Windows 10/Windows Server OS Build: 10.0.18362 Target Name: NACORP NetBIOS Domain Name: NACORP NetBIOS Computer Name: 1234ABC DNS Domain Name: na.corp.xxxxx.com System Time: 2021-12-12 22:55:40.534959 Authorized Use Only - v 041001 This system is for the use of authorized users only. How do I extract specific pieces from it?  I need NetBIOS Domain Name and Computer Name and System Time I thought of using a regex but not sure how to build it since NetBIOS Domain Name values can be of different variations e'g one will be NACORP another one will be USON and another wil be NACORP.LOCAL Similar with the computer name - there's no unified naming convention - it depends on a country we get the logs from. some can have a "-" in the middle, some will have a "." etc. Any hints and tips on how to tackle it will be more than appreciated! ... View more

Hi folks,  Hoping you might be able to help.  I've some raw logs coming in and one of the "extracted" fields is a fields with all the system information I need e.g. Remote Desktop Protocol: OS: Windows 10/Windows Server OS Build: 10.0.18362 Target Name: NACORP NetBIOS Domain Name: NACORP NetBIOS Computer Name: 1234ABC DNS Domain Name: na.corp.xxxxx.com System Time: 2021-12-12 22:55:40.534959 Authorized Use Only - v 041001 This system is for the use of authorized users only.  How do I extract specific pieces from it?  I need NetBIOS Domain Name and Computer Name and System Time I thought of using a regex but not sure how to build it since NetBIOS Domain Name values can be of different variations e'g one will be NACORP another one will be USON and another wil be NACORP.LOCAL  Similar with the computer name - there's no unified naming convention - it depends on a country we get the logs from. some can have a "-" in the middle, some will have a "." etc. Any hints and tips on how to tackle it will be more than appreciated! ... View more

Hello,  I'd like to create a search for a multiple alerts on the same host. The idea would be to get results for each host that would see more than 10 malicious files alerts within let's say last 72hours from now. I tried something like this:  index=xyz sourcetype=xyz:123  | bin span=1d createdDate | eval createdDate_epoch=strptime(createdDate,"%Y-%m-%d") | eval today_epoch=now() `comment("#### ####")` | eval days_lapsed=round((today_epoch - createdDate_epoch)/86400,0) | where days_lapsed <=3 | stats earliest(createdDate) as createdDate ```values(file_name) as file_name values(filePath) as filePath values(agentComputerName) as agentComputerName``` values(category) as category values(siteName) as siteName values(file_hash) as file_hash values(signature) as signature dc(file_name) as number_of_alerts max(days_lapsed) as days_lapsed by agentComputerName | where number_of_alerts >4 In my case that gives me that there were 5 alerts for malicious files (some of the files occurred more than once in these 3 days) And all would be great if not the fact that I have only one date (createdDate), where I'd like to see all dates per each file and when the file was created.  How do I need to modify my search to get where I need to be? Thank you!  ... View more

Hi guys,  I'm looking to add a new column to my inputlookup.  The idea is to mark the values that repeat e.g.:  Email Threat Attachment Delivered Analytics Voice mail spam Network Jira Heartbeat N/A Voice mail spam Network   And do something like this:  Name Zone Repeats Email Threat Attachment Delivered Analytics No Voice mail spam Network Yes Jira Heartbeat N/A No Voice mail spam Network Yes   I know I can just do a | stats count by Name, but that doesn't solve my problem. Any hints on how to solve it would be greatly appreciated 🙂  ... View more

Hi guys, I'm hoping for a bit of a help. My total_bytes and src_zone aren't populating. I tried few things at groupby stage both in stats and tstats, At this point I'm running out of ideas on how to fix it. Can you please have a look at it? | tstats summariesonly=t prestats=t latest(_time) as _time values(All_Traffic.user) as All_Traffic.user, values(All_Traffic.dest_translated_ip) as All_Traffic.dest_translated_ip, values(All_Traffic.rule) as All_Traffic.rule, values(All_Traffic.src_zone) as All_Traffic.src_zone values(All_Traffic.dest_zone) as All_Traffic.dest_zone, values sum(All_Traffic.bytes) AS All_Traffic.bytes values(sourcetype) as sourcetype count from datamodel=Network_Traffic where (nodename = All_Traffic) NOT (index="zscaler") All_Traffic.src_ip="10.24.224.12" All_Traffic.dest_ip="213.52.102.12" groupby All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.action All_Traffic.app | tstats summariesonly=t prestats=t append=t latest(_time) as _time values(Web.user) as Web.user, sum(Web.bytes) AS Web.bytes values(sourcetype) as sourcetype count from datamodel=Web where (nodename = Web) Web.src="10.24.224.12" Web.dest_ip="213.52.102.12" groupby Web.src Web.dest_ip Web.action Web.url Web.app | eval src=case(isnotnull('All_Traffic.src_ip'), 'All_Traffic.src_ip', isnotnull('Web.src'), 'Web.src') | eval dest=case(isnotnull('All_Traffic.dest_ip'), 'All_Traffic.dest_ip', isnotnull('Web.dest_ip'), 'Web.dest_ip') | eval action=case(isnotnull('All_Traffic.action'), 'All_Traffic.action', isnotnull('Web.action'), 'Web.action') | eval All_Traffic_url="N/A" | eval app=case(isnotnull('All_Traffic.app'), 'All_Traffic.app', isnotnull('Web.app'), 'Web.app') | stats latest(_time) as _time values(All_Traffic_url) as All_Traffic_url values(All_Traffic.app) as All_Traffic.app values(Web.app) as Web.app values(Web.user) as Web.user, values(All_Traffic.user) as All_Traffic.user, values(All_Traffic.dest_translated_ip) as dest_translated_ip, values(All_Traffic.dest_zone) as dest_zone, values(All_Traffic.src_zone) as src_zone values(All_Traffic.rule) as rule, sum(All_Traffic.bytes) AS All_Traffic.bytes, sum(Web.bytes) AS Web.bytes, values(sourcetype) as sourcetype, count by src dest action app Web.url | eval user=case(isnotnull('All_Traffic.user'), 'All_Traffic.user', isnotnull('Web.user'), 'Web.user') | eval url=case(isnotnull('Web.url'), 'Web.url', isnotnull(All_Traffic_url), All_Traffic_url) | stats latest(_time) as _time values(user) as user, values(All_Traffic.dest_translated_ip) as dest_translated_ip, values(All_Traffic.src_zone) as src_zone, values(All_Traffic.dest_zone) as dest_zone, values(All_Traffic.rule) as rule, sum(All_Traffic.bytes) AS All_Traffic.bytes, sum(Web.bytes) AS Web.bytes, values(sourcetype) as sourcetype count by src dest action app url | fillnull value=0 All_Traffic.bytes, Web.bytes | eval total_bytes='All_Traffic.bytes'+'Web.bytes' | eval total_bytes=tostring(total_bytes/1024/1024, "commas") + " MB" | fillnull value="N/A" src, src_zone, dest, dest_dns, dest_translated_ip_dns, dest_zone, action, app, rule, user | fields _time, sourcetype src, src_zone, dest, dest_dns, dest_translated_ip_dns, dest_zone, action, app, rule, user, total_bytes, count, url   Thanks in advance!  ... View more

Hi guys,  This little (?) thing's has been wrecking my head all weekend. I'm trying to merge 2 stats commands, or somehow make my search look neater.  I want to see the number of emails sent to a specific person, but some of the events are showing up as 1, despite having few recipients.      The only way i can get this result is where I do 2 separate stats commands one after the other:  | stats last(eventTime) as Detected_Time , values(quarantineFolder) as Type , values(senderIP) as Sender_IP , values("threatsInfoMap{}.threatType") as threat_type, values("threatsInfoMap{}.threat") as threat, values("threatsInfoMap{}.threatUrl") as threatUrl, values(malwareScore) as malwareScore by Email_Sender Email_Recipient | eventstats count as Recipient_occurrence by Email_Recipient | stats last(Detected_Time) as Detected_Time , values(Email_Recipient) as Email_Recipient list(Recipient_occurrence) as Recipient_occurrence values(Type) as Type , values(Sender_IP) as Sender_IP , values(threat_type) as threat_type, values(threat) as threat, values(threatUrl) as threatUrl, values(malwareScore) as malwareScore by Email_Sender | where isnotnull(Email_Sender)   Is there any other way to make it look better and more tidy? Any help and tips will be greatly appreciated!  ... View more

Hi guys,  I'm trying to create a saved search (instead of  typing the same search command few times a day) , but there's a small "catch" in my search - I want to put multiple choice as one of the variables.  e.g. Long search:  index=console1(sourcetype=c1:agent OR sourcetype="c1:agent_registered") computerName="computer1 OR computer2 OR computer25  | stats count by host   I created a basic saved seach: index=console1(sourcetype=c1:agent OR sourcetype="c1:agent_registered") $computerName$ | stats count by host  So my computerName can be different every time i need to check a new machine., but I can only one at a time... Is there a way to add that option to my saved search? ... View more

Hi guys, New to Splunk so pardon the simplicity of my question! Im trying to bounce my csv list off another one. I've a list of servers in my spreadsheet, uploaded it to a lookup table files. By my problem is (I think) that the other file has the server names in a different format. Eg. my server name is lets say "gb1234" and the other file it's saved as "UK gb1234" or "EU UK gb1234"   I came up with a basic search command:  | inputlookup MY_LIST.csv | eval host=upper(host) | lookup OTHER_LIST asset_key as host | fields host, asset_version, asset_bu   But I'm guessing that because of the format in the search i need to use regex.... But where and how??     ... View more