Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Ash
Ash
Engager
Member since:
09-02-2022
12-28-2022
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 09-02-2022 |
Activity Feed
- Posted How do I build this Sysmon log search without having required fields? on Splunk Search. 11-23-2022 03:25 AM
- Posted How to know the correlation search query and time range conditions for two of these use cases? on Splunk Enterprise Security. 10-18-2022 05:46 AM
- Posted Search for failed logins: Why is the search creating false positive alerts? on Splunk Enterprise Security. 10-13-2022 09:35 AM
- Posted Re: Why does it say there are events but then it says "No results found"? on Splunk Search. 10-07-2022 01:36 AM
- Posted Re: Input lookup results on Splunk Enterprise Security. 09-23-2022 07:10 AM
- Posted Input lookup results: How to exclude results from Lookups? on Splunk Enterprise Security. 09-23-2022 06:39 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-23-2022
03:25 AM
I want to implement this correlation search:
`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter`
I do not have the required fields from Sysmon log data. I have fields like Image,ParentImage,Processid but do not have TargetImage, TargetProcessId, SourceImage, SourceProcessId. How do I build the above query using the fields I have.
... View more
10-18-2022
05:46 AM
Please let me know the correlation search query and time range conditions for two of these usecases. I have windows powershell logs onboarded.
1. Suspicious Windows Shell Launched by Web Applications
2. Suspicious Windows Shell Launched by a trusted process
... View more
Labels
10-13-2022
09:35 AM
Hello,
I have created a search for failed logins for win,linux and network devices from authentication datamodel but this is generating lot of false positive alerts. Please help me to finetune this search
| from datamodel:"Authentication"."Failed_Authentication" | search NOT user IN ("sam","sunil") | stats values(signature) as signature, dc(user) as "user_count", dc(dest) as "dest_count" latest(_raw) as orig_raw, count by "app","src",user | where 'count'>=200 AND user_count=1 | head 5
... View more
- Tags:
- alert
- failed-logins
Labels
- Labels:
-
using Enterprise Security
10-07-2022
01:36 AM
What should be modified in the search to display the events in Verbose mode
... View more
09-23-2022
07:10 AM
Thanks you it helped. BTW what for where isnull(is_blocked) is used.
... View more
09-23-2022
06:39 AM
Hi,
index=network sourcetype=cisco:asa NOT src_ip IN("10.0.0.0/8","10.0.0.1,"10.0.0.2") | bucket _time span=1m | stats dc(dest_port) as num_dest_port dc(dest_ip) as num_dest_ip by src_ip _time | where num_dest_port > 500 OR num_dest_ip > 500 | eval Total=num_dest_port+num_dest_ip | sort -Total | dedup src_ip |
With Lookups:
index=network sourcetype=cisco:asa NOT src_ip IN("10.0.0.0/8","10.0.0.0/8","10.0.0.1,"10.0.0.2") | search NOT [|inputlookup Blocked_IP.csv] | fields src_ip | bucket _time span=1m | stats dc(dest_port) as num_dest_port dc(dest_ip) as num_dest_ip by src_ip _time | where num_dest_port > 500 OR num_dest_ip > 500 | eval Total=num_dest_port+num_dest_ip | sort -Total | dedup src_ip
I am not able to exclude the results from the Lookups or if I modify the search I'm not getting any results at all. Kindly help.
... View more
- Tags:
- lookup
Labels
- Labels:
-
correlation search
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-28-2022
06:18 AM
|
