Hello Splunkers, I have two lookups which are need to join. In lookup1.csv its containing the Rule name and the technique id in the columns and in lookup2.csv it contains the technique id and the tactic name in the columns. Now i have joined the two lookups and got the result. Now the problem i am facing is that if the rule is having the multiple tactics name then the output result is displaying them in the same single field (screenshot attached). But i need the result as if the rule is having two tactic names then it should display 2 times the rule name and the tactic names individually. the query i used to join the lookups is | inputlookup lookup1.csv | lookup lookup2.csv technique_id     Waiting for the response....   Thanks in advance ... View more

Hello Splunkers, I have used a query in the search for mitre fields extraction and after the extraction i have got the results with the query name and the technique_id. But here the problem comes. Each query is having the technique_id and the sub technique_id, so i have matched the sub technique_id with the technique_id and the results is shown with the same rule name two times with the technique_id. So i want to remove  the duplicate rule name, if so i used the dedup then the rule having the other technique_id is also getting removed. I have attached the screenshot for reference... The query i used for getting the results is  | rest /services/configs/conf-analyticstories | where annotations!="" | spath input=annotations path=mitre_attack{} output=mitre_attack | eval rule_name=ltrim(title,"savedsearch://") | fields rule_name,mitre_attack | join rule_name [| rest /services/configs/conf-analyticstories | where searches!="" | eval rule_name=searches | table title,rule_name | eval rule_name=trim(rule_name,"[") | eval rule_name=trim(rule_name,"]") | eval rule_name=split(rule_name,",") | mvexpand rule_name | eval rule_name=trim(rule_name," ") | eval rule_name=trim(rule_name,"\"") ] | append [| rest services/configs/conf-savedsearches | eval rule_name=title | search action.correlationsearch.annotations="*" | spath input=action.correlationsearch.annotations path=mitre_attack{} output=mitre_attack | fields rule_name, mitre_attack] | eval technique_name = if(match(mitre_attack,"^T\d\d\d"),null(), mitre_attack) | lookup mitre_tt_lookup technique_name OUTPUT technique_id as tmp_id0 | eval tmp_id1 = if(match(mitre_attack,"^T\d\d\d"), mitre_attack, null()) | eval technique_id=coalesce(tmp_id0, tmp_id1) | where NOT isnull(technique_id) | table rule_name, technique_id | inputlookup mitre_user_rule_technique_lookup append=true | inputlookup mitre_app_rule_technique_lookup append=true | makemv tokenizer="([^\n\s]+)" technique_id | mvexpand technique_id | dedup rule_name,technique_id | join rule_name [| rest services/configs/conf-savedsearches | eval rule_name=title | eval stage= if(disabled == 1, "Disabled", "Enabled") | table rule_name, stage ] | eval subtechnique_id=if(match(technique_id,"\."),technique_id,null()) | eval technique_id=if(match(technique_id,"\."),replace(technique_id,"\.\d+",""),technique_id) |search stage=Enabled |table rule_name,technique_id     Thanks in advance.... ... View more

Hello Guys,  I am getting confused about this below query,  can anyone help me to understand it. Actually in the search query there is "AND" commands with the same Field name, I am not getting to know how the "AND" command works here for same field. If its a "OR" command then the query will check for both the values, but where as coming to "AND" command how does it works in the same field name. Can someone help me out regarding this.... index=* source="WinEventLog:Microsoft-Windows-PowerShell/Operational" AND ((EventCode="800" AND EventData="*-ItemProperty*" AND EventData="*\\SYSTEM\\CurrentControlSet\\Control\\Lsa*" AND EventData="*DsrmAdminLogonBehavior*") OR (EventCode="4103" AND Payload="*-ItemProperty*" AND Payload="*\\SYSTEM\\CurrentControlSet\\Control\\Lsa*" AND Payload="*DsrmAdminLogonBehavior*") OR (EventCode="4104" AND ScriptBlockText="*-ItemProperty*" AND ScriptBlockText="*\\SYSTEM\\CurrentControlSet\\Control\\Lsa*" AND ScriptBlockText="*DsrmAdminLogonBehavior*")) Thanks in advance...... ... View more