About or1515

or1515 · ‎09-11-2021

Alright, but again its not what I need. I want to make a time space between the first search to the second search. In this what sparate between both searches is: | join user Now, I want another time field that will sparate between the first search to the second search. Like 1m/1h/1d between the first search to the second. Than, it will become a correlation security search between 2 diffrent indexes that will combined with the same field and for example 1h different time.

or1515 · ‎09-09-2021

Alright, thanks. 1. For what the last row stands for? | stats values(*) as * by user why the values are with *? 2. I want a time distance between the first search to the second search (Like 5-10 min).

or1515 · ‎09-09-2021

This is the query: index="net" sourcetype="Okta" eventType="user.account.privilege.grant" In the log there is field called "Username". I want to change it to "User". You ask why? I want to write a correlation rule from 2 different indexes and I want to use the same field for both. Im waiting for an answer here: https://community.splunk.com/t5/Security/Correlation-rule/m-p/566419#M15581

or1515 · ‎09-09-2021

Again it's not what I search for. I want to correlate 2 different indexes with different fields. 1. Cisco FW - suspicious IP address entered the internal network. 2. Crowdstrike - Suspious Ip address scanning In the Cisco the IP address fields wrote: IP_Address In the Crowdstrike its: IPaddress I want to combine both events by the same field (IP Address) with a time range between both events. I hope there is a solution for that 🙂

or1515 · ‎09-09-2021

Hey splunkers, How do I create a new field in splunk? If I have a windows security log with "User" field and I want to call it and use it as "Account". I tried we Eval but didn't succeed. Thanks.

or1515 · ‎09-09-2021

Thanks for your response. How can I set a time range between both searches? Like search 2 occurring after 10 min?

or1515 · ‎09-08-2021

Can you write an example please?

or1515 · ‎09-08-2021

Hey splunkers, How can I correlate rules in Splunk from 2 data sources? The events for example: OKTA - privilege granted index="network" sourcetype="OktaIM2:log" eventType="user.account.privilege.grant" + Windows - Event Auditing disabled index="WinEventLog" sourcetype="WinEventLog" EventCode="4719" AuditPolicyChanges="removed" I want to correlate first Okta event and then the Windows event with the same field (for example Username) in 10 min.

or1515 · ‎05-16-2021

Hi! There is another way to create a query with EventID ("user-created") and then EvendID ("user deleted") in 5 min? I just want to create a correlation rule with two operations (one after the other) and show display the relevant fields (with the "stats" command). index=ph_windows_sec sourcetype=XmlWinEventLog (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) earliest=-14d | stats values(TargetUserName) as TargetUserName ,values(signature) as Message, count by Caller_User_Name | eval status=case(EventCode=630, \"Account%20Deletion\", EventCode=4726, \"Account%20Deletion\", EventCode=624, \"Account%20Creation\", EventCode=4720, \"Account%20Creation\") | transaction user startswith=status=\"Account%20Creation\" endswith=status=\"Account%20Deletion\" maxevents=2 | where duration < 3600

or1515 · ‎05-10-2021

Thanks for your response. There is another way to create a query with EventID ("user-created") and then EvendID ("user deleted") on 5 min? I just want to create a correlation rule with two operations (one after the other) and show display the relevant fields (with the "stats" command).

or1515 · ‎05-10-2021

Hi, My query: index=ph_windows_sec sourcetype=XmlWinEventLog (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) earliest=-14d | stats values(TargetUserName) as TargetUserName ,values(signature) as Message, count by Caller_User_Name | eval status=case(EventCode=630, \"Account%20Deletion\", EventCode=4726, \"Account%20Deletion\", EventCode=624, \"Account%20Creation\", EventCode=4720, \"Account%20Creation\") | transaction user startswith=status=\"Account%20Creation\" endswith=status=\"Account%20Deletion\" maxevents=2 | where duration < 3600 When I add "Stats values", the query isn't found any hit. When I delete "Stats values", the query returns with hits. What is wrong with my query? 🙂 Thanks!

Posts	11
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-10-2021

Online Status	Offline
Date Last Visited	‎09-19-2021 04:48 AM

How do I create a new field?

Correlation rule

How do I build correlation rule? "Account was crea...

account was created and deleted

Re: Correlation rule

Re: Correlation rule

Re: How do I create a new field?

Re: Correlation rule

How do I create a new field?

Re: Correlation rule

Re: Correlation rule

Correlation rule

How do I build correlation rule? "Account was crea...

Re: account was created and deleted

account was created and deleted