I have a lookup file.  Lookup has "host", "count", "first_event" and "last_event" fields.  I want to run a search hourly that will update all the fields with fresh values and in the event that a "host" is not found in the search send an alert. Any guidance would be appreciated. ... View more

Using the "virustotal" cmd and it appears that if there are multiple events that have the same file_hash that only one of the events will "populate" the field/values from the virustotal cmd.  I can't post events. Example would be: event 1: _time=08/06/2023 07:00:00 dest=abc1 file_hash=45vv678 file_name=badguy.dll file_path=my_path vt_* will be populated event 2: _time=08/06/2023 07:150:00 dest=abc2 file_hash=45vv678 file_name=badguy.dll file_path=my_path vt_* - nothing will be populated event 3: _time=08/06/2023 07:30:00 dest=abc3 file_hash=45vv678 file_name=badguy.dll file_path=my_path vt_* - nothing will be populated I know the spl is fine as if I were to change the time picker to that of just the 2nd or 3rd event, all the vt_ fields would be populated.  It looks like this is the expected behavior.  Thanks in advance. ... View more

I have logs (Azure logs) that have two time fields, StartTime and ExpirationTime. Example: index=azure sourcetype=my_sourcetype | table StartTime ExpirationTime role user I want to take the user and see if the user had a failed login attempt in another index / sourcetype between the two time fields StartTime and ExpirationTime. Any help would be greatly appreciated. ... View more

I have a field called properties.requestbody.  I would like to have this field broken out based on the field and values paired.  I've tried with spath and no luck.  I've used and am using rename to extract the field / values in other parts of the logged events.  Not having luck with this field.  I think it has to do with the quotes but I'm not certain.  Thanks as always for the help and guidance. "properties": {"requestbody": "{\"properties\":{\"description\":\"Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The Private Link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to diskAccesses, data leakage risks are reduced. Learn more about private links at: https://aka.ms/disksprivatelinksdoc. \",\"displayName\":\"COMP-015N-Disk access resources should use private link-AuditIfNotExists-BUL\",\"metadata\":\"******\",\"mode\":\"Indexed\",\"parameters\":\"******\",\"policyRule\":\"******\",\"policyType\":\"Custom\"}}" ... View more

I have a subsearch that is used to pull user, and start and expiration time fields.  I want to use the two time fields from the sub search to be the time frame the outter search uses to pull events. I'm not familiar with how to do this. earliest=<ealiest_from_subsearch> latest=<latest_from_subsearch index=myindex sourcetype=my_st_2 <my spl> | join user [ search index=myindex sourcetype=my_st <my spl> | eval earliest = strptime(StartTime, "%Y-%m-%dT%H:%M:%S.%N") -18000, latest = strptime(ExpirationTime, "%Y-%m-%dT%H:%M:%S.%N") -18000 | fields user earliest latest user_role ] table user role failure_code failure_reason Thanks for the help and guidance. ... View more

I have a lookup file that has 5 columns.  Those are src_ip, dest_ip, dest_port, signature and active. src_ip has 18 values while the dest_ip has 50 values.  Signature is based on the dest_ip field, meaning 30 of the dest_ip we'll see a signature named "ssh login."  The other 20 sigs will be "ftp login."  sigs that are "ssh login" will always be dest_port=22 and sig "ftp login" will always be dest_port=21. The src_ip can hit any of the destinations / dest_ports / signatures. I've tried this in my search but it falls short of adding in the src_ip against all the dest_ip. | inputlookup exclusion_list.csv | fields src_ip dest_ip dest_port signature | format | table search The issue I'm seeing is once the search gets to a row in the lookup file that doesn't contain a src_ip it doesn't add on to the results.  So in essence I end up with 18 line that have: ( (dest_ip=xxxx AND dest_port=22 AND signature=xxx AND src_ip=yyyy) OR (dest_ip=xxxx AND dest_port=22 AND signature=xxx) ) I can't figure out how to make the command sedn the src_ip's to all the dest_ip / dest_port / signature combos. This is hard to write out what I want but hopefully there is some help out there.  Thanks in advance. ... View more