About md

md · ‎02-24-2023

I know this is an old one, but I wanted to make sure this info is out there. The Splunk Add-on for Microsoft Windows now handles this. Just add host=WinEventLogForwardHost to the [WinEventLog://ForwardedEvents] monitoring stanza.

md · ‎12-09-2022

We ended up using having to use lookup instead of inputlookup. This is what we came up with: base search | call_to_macro(ip_field, port_field) The macro adds a field named translated_IP to the event with either the PAT translated IP or the original IP if it's not a PAT IP. For the macro: eval translated_IP=$ip_field$, port=$port_field$ | rex field=translated_IP "(?<first3octets>\d{1,3}\.\d{1,3}\.\d{1,3})(?<lastoctet>\.\d{1,3})" ```This lookup returns all port ranges for that group of the first 3 octets of the address as 3 separate multivalue fields.``` | lookup PAT_Address_Translation Public_Address AS first3octets OUTPUT Private_Address, Lower_Port, Upper_Port ```mvzip ties together the values of 2 multivalue fields in the order they appear. We have to nest them since we have 3 multivalue fields.``` | eval port_range=mvzip(mvzip(Private_Address,Lower_Port),Upper_Port) ```In cases where the input IP is not in the PAT IP range, we need to make sure port_range is not null or mvexpand errors out.``` | eval port_range=coalesce(port_range, "") ```mvexpand turns each possible value into it's own row.``` | mvexpand port_range ```we then separate the fields and use a where command to eliminate the values that the port_field isn't within the range of.``` | rex field=port_range "(?<Private_Address>\d{1,3}\.\d{1,3}\.\d{1,3}),(?<Lower_Port>\d+),(?<Upper_Port>\d+)" | where (Lower_Port<=port AND Upper_Port>=port) OR port_range="" | eval internal_IP=Private_Address.lastoctet ```Finally, we make sure translated_IP is either the translated result or the original IP if it's not in the PAT table``` | eval translated_IP=coalesce(internal_IP,translated_IP) ```Clean up of added fields``` | fields - Lower_Port,Upper_Port,Private_Address,first3octets,lastoctet,internal_IP,port_range

md · ‎11-07-2022

I have a KV store based lookup for Port Address Translation. Given the first 3 octets of a public facing IP and a port, I need to lookup the first 3 octets of the private address from this lookup. The lookup contains the first 3 octets of the public IP, the first 3 octets of the private IP, the maximum port for that private IP and the minimum port for that private subnet range. Starting with a public_address of 123.45.67.8, port 1042 something like this works: | inputlookup PAT_translation_table where public_address="123.45.67" lower_port<="1042" upper_port>="1042" It returns the field private_address with a value like 10.1.2 and then I append on the .8 to get the internal IP. I need to be able to do this with multiple results from other searches, however. Something like this: <initial search results that include src_ip and src_port> | rex field=src_ip "(?<first3octets>\d{1,3}\.\d{1,3}\.\d{1,3})(?<lastoctet>\.\d{1,3}) | inputlookup PAT_translation_table append=true where 'public_address'=first3octets 'lower_port'<=src_port 'upper_port'>=src_port In this example, inputlookup returns nothing. If I just use the lookup command, I can't use greater than or less than so it returns all the values as an mvfield for private_address, an mvfield for upper_port, and a separate mvfield for lower_port. How would I query that?! Do any of you have any suggestions how I can do this?

md · ‎07-31-2021

Hello all, I'm trying to create an alert for Successful Brute Force Attempts using the Authentication Data Model. Currently, I'm doing this: | tstats summariesonly=true count as success FROM datamodel=Authentication where Authentication.user!="*$*" AND Authentication.action="success" BY _time span=60m sourcetype Authentication.src Authentication.user | join max=0 _time, sourcetype, Authentication.src, Authentication.user [| tstats summariesonly=true count as failure FROM datamodel=Authentication where Authentication.user!="*$*" AND Authentication.action="failure" BY _time span=60m sourcetype Authentication.src Authentication.user] | search success>0 AND failure>0 | where success<(failure*.05) | rename Authentication.* as * | lookup dnslookup clientip as src OUTPUT clienthost as src_host | table _time, user, src, src_host, sourcetype, failure, success It aggregates the successful and failed logins by each user for each src by sourcetype by hour. Then it returns the info when a user has failed to authenticate to a specific sourcetype from a specific src at least 95% of the time within the hour, but not 100% (the user tried to login a bunch of times, most of their login attempts failed, but at least one of the login attempts succeeded). What everyone else would like me to do is look for the traditional pattern for finding Successful Brute Force Attempts - many failed logins followed by a successful one. I can't seem to find an efficient way of doing that with the Splunk Authentication Data Model. We get a over a million authentication attempts per day and just under 100,000 of those are failures. We can't afford Splunk Enterprise Security (Higher Ed) and my understanding is that this is more or less how ES Successful Brute Force Detection works anyways. Do any of you have any advice on finding a pattern of a large number of something (failures, whatever) followed by something else (success, etc.)?

Posts	4
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎07-31-2021

Online Status	Offline
Date Last Visited	‎02-24-2023 04:59 PM

How to use field values with greater than and less...

Successful Brute Force Attempts using the Authenti...

Re: WinEventLog:ForwardedEvents override

Re: Using field values with greater than and less ...

How to use field values with greater than and less...

Successful Brute Force Attempts using the Authenti...