Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Daksesh
Daksesh
Explorer
Member since:
12-21-2022
01-23-2023
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-21-2022 |
Activity Feed
- Posted Re: Field extractions in props.conf on Splunk Enterprise. 01-22-2023 09:36 PM
- Posted Re: Field extractions on Splunk Search. 01-22-2023 09:35 PM
- Posted Re: Field extractions in props.conf on Splunk Enterprise. 01-20-2023 04:01 AM
- Posted Re: Field extractions on Splunk Search. 01-20-2023 04:00 AM
- Posted Re: Field extractions in props.conf on Splunk Enterprise. 01-19-2023 08:33 AM
- Posted Re: Field extractions on Splunk Search. 01-19-2023 03:26 AM
- Posted How can a regex query be written to extract source IP address? on Splunk Search. 01-18-2023 10:33 PM
- Posted How to do Field extractions in props.conf? on Splunk Enterprise. 01-18-2023 09:48 PM
- Posted Re: Checkpoint Antibot related logs are not appearing in the datamodel? on All Apps and Add-ons. 01-18-2023 09:38 PM
- Posted Checkpoint Antibot related logs are not appearing in the datamodel? on All Apps and Add-ons. 01-02-2023 04:54 AM
- Posted Re: To extract fields in the data model on Splunk Enterprise. 12-28-2022 03:26 AM
- Posted Re: To extract fields in the data model on Splunk Enterprise. 12-28-2022 03:25 AM
- Posted Re: To extract fields in the data model on Splunk Enterprise. 12-26-2022 12:12 AM
- Posted Re: To extract fields in the data model on Splunk Enterprise. 12-22-2022 07:13 AM
- Posted How to extract fields in the data model? on Splunk Enterprise. 12-21-2022 06:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-22-2023
09:36 PM
Hi, Had written regex in the props.conf file, but field extractions are not observing in Search head. Please find the below props.conf file configuration. could you please guide me if anything to be included in props.conf file. Thank you
... View more
01-22-2023
09:35 PM
Hi, Had written regex in the props.conf file, but field extractions are not observing in Search head. Please find the below configuration. could you please guide me if anything to be included in props.conf file. Thank you
... View more
01-20-2023
04:01 AM
Hi , Thank you for your inputs. I have written same regex in the props.conf file in Splunk heavy forwarder, but field extractions are not happening in search head. Could you please guide me if there is any mistake from my end. Below is the props.conf file [user@XXXXX local]$ cat props.conf [cp_log1] category = Custom pulldown_type = 1 [wsa_test] category = Custom EXTRACT-src_ipaddress = .+[^\d](?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) EXTRACT-dest_ipaddress = TCP_(.+[^\d](?<dstipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):\d) EXTRACT-domain = https?:\/\/(?<domain>.*?(?:.com|.net)) EXTRACT-username = GOLDBAR\\(?<username>[\w]+) pulldown_type = 1 Thank you
... View more
01-20-2023
04:00 AM
Hi , Thank you for your inputs. I have written same regex in the props.conf file in Splunk heavy forwarder, but field extractions are not happening in search head. Could you please guide me if there is any mistake from my end. Below is the props.conf file [user@XXXXX local]$ cat props.conf [cp_log1] category = Custom pulldown_type = 1 [wsa_test] category = Custom EXTRACT-src_ipaddress = .+[^\d](?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) EXTRACT-dest_ipaddress = TCP_(.+[^\d](?<dstipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):\d) EXTRACT-domain = https?:\/\/(?<domain>.*?(?:.com|.net)) EXTRACT-username = GOLDBAR\\(?<username>[\w]+) pulldown_type = 1 Thank you
... View more
01-19-2023
08:33 AM
Hi Rich, Thank you for your answer. After applying below regex is not capturing .com and .net at the end. https?:\/\/(?<domain>.*?)(?:.com|.net) Below is the output activity.windows px.ads.linkedin And also the above regex is not capturing domain/url details for the below sample log receiving from same device. Could you please help on this. <14>Jan 19 04:32:59 xxxxx accesslog_SIEM: Info: 1674102779.144 250 - 1x.1xx.1xx.xx TCP_MISS_SSL/200 0 TCP_CONNECT 192.111.4.115:443 cloud-ec-asn.amp.cisco.com - - - DECRYPT_ADMIN_2-NONE-DOMPVM.Generalusers.ID-NONE-NONE-NONE-DefaultGroup-NONE - 55009 cloud-ec-asn.amp.cisco.com 443 2 IW_comp 9.4 1 - - - - - - - - - - - - - - - - IW_comp - "Computers and Internet" "Unknown" "Unknown" - - 0.00 0 - - - - - - - - - - - - - - 0
... View more
01-19-2023
03:26 AM
Hi , Thank you for your answer. The output of above command gives results both source IP address(10.130.130.33) and destination IP address(192.111.4.115) in the same field ipaddress. Would like to separate Source IP address and Destination IP address in props.conf file in Heavy forwarder. Could you please help on this. Below is the sample log line. <14>Jan 19 04:32:59 xxxxx accesslog_SIEM: Info: 1674102779.144 250 - 10.130.130.33 TCP_MISS_SSL/200 0 TCP_CONNECT 192.111.4.115:443 cloud-ec-asn.amp.cisco.com - - - DECRYPT_ADMIN_2-NONE-DOMPVM.Generalusers.ID-NONE-NONE-NONE-DefaultGroup-NONE - 55009 cloud-ec-asn.amp.cisco.com 443 2 IW_comp 9.4 1 - - - - - - - - - - - - - - - - IW_comp - "Computers and Internet" "Unknown" "Unknown" - - 0.00 0 - - - - - - - - - - - - - - 0
... View more
01-18-2023
10:33 PM
The position of IP address is getting changed(appearing before or after https) in the logs, in such scenario how regex query can be written to extract source IP address.
Please guide me.
Below are the sample logs.
<14>Jan 19 04:32:59 XXXX accesslog_SIEM: Info: 1674102779.121 7 - 10.130.130.152 TCP_DENIED_SSL/403 0 POST https://activity.windows.com:443/v3/feeds/me/$batch - v3/feeds/me/$batch "Domainname\user@Domainname" - DROP_WEBCAT_7-BGC.BlockInternetAccess.DP-DOMPVM.Generalusers.ID-NONE-NONE-NONE-NONE-NONE - 61519 activity.windows.com 443 1 IW_comp 5.0 - - - - - - - - - - - - - - - - - IW_comp - "Computers and Internet" "Unknown" "Unknown" - - 0.00 0 - - - - - - - - - - - - - "SGPlatform 2.0" 21040
<14>Jan 19 04:32:59 XXXX accesslog_SIEM: Info: 1674102778.930 114 "https://www.XXX.com/English/home/default.aspx" 10.130.80.223 TCP_CLIENT_REFRESH_MISS_SSL/200 785 GET https://px.ads.linkedin.com:443/collect?v=2&fmt=js&pid=4881225&time=1674102778231&url=https%3A%2F%2Fwww.XXX.com%2FEnglish%2Fhome%2Fdefault.aspx&cookiesTest=true&liSync=true px.ads.linkedin.com collect?v=2&fmt=js&pid=4881225&time=1674102778231&url=https%3A%2F%2Fwww.XXX.com%2FEnglish%2Fhome%2Fdefault.aspx&cookiesTest=true&liSync=true - application/javascript ALLOW_CUSTOMCAT_12-ZAMLUM.FullAccess.AP-AuthByPass.ID-NONE-NONE-NONE-DefaultGroup-NONE - 54083 px.ads.linkedin.com 443 1 C_Allo 4.0 - - - - - - - - - - - - - - - - - IW_snet - "Social Networking" "Unknown" "Unknown" - - 55.09 0 - - - - - - - - - - - - - "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) browser/2020.2.6 Chrome/87.0.4280.141 Electron/11.3.99 Safari/537.36 PingdomTMS/2020.2" 1162
... View more
- Tags:
- ip-address
- regex
Labels
- Labels:
-
field extraction
01-18-2023
09:48 PM
Hello Everyone,
I'm new to regex, can you please support to extract URL name only until .com or .net only.
This regex GET\s\w+:(?<URL>[^"]+), capturing whole thing, but I would require to capture only until .com and .net.
Also please support to get the fields http_method, status
below is the sample log line.
<14>Jan 19 04:32:59 XXXXXX accesslog_SIEM: Info: 1674102779.113 336 - 10.X.X.X TCP_MISS/200 271 GET http://us-hnl-anx-r001.router.teamviewer.com/din.aspx?s=00000000&id=909083993&client=DynGate&p=10000001 us-hnl-anx-r001.router.teamviewer.com din.aspx?s=00000000&id=909083993&client=DynGate&p=10000001 - application/octet-stream DEFAULT_CASE_12-DOMPVM.WebControl.AP-DOMPVM.WebControl.ID-NONE-NONE-NONE-DefaultGroup-NONE - 53843 us-hnl-anx-r001.router.teamviewer.com 80 1 IW_meet 5.0 0 - "0" 0 0 1 - - - - - 0 0 - - - - IW_meet - "Online Meetings" "TeamViewer" "Presentation / Conferencing" - - 6.45 0 - - 0 "Unknown" - 0 "Unknown" - - - - - - "Mozilla/4.0 (compatible; MSIE 6.0; DynGate)" 191
<14>Jan 19 04:32:59 XXXXX accesslog_SIEM: Info: 1674102779.121 7 - 10.130.130.152 TCP_DENIED_SSL/403 0 POST https://activity.windows.com:443/v3/feeds/me/$batch - v3/feeds/me/$batch "INDIADomain\username@INDIADomain" - DROP_WEBCAT_7-BGC.BlockInternetAccess.DP-DOMPVM.Generalusers.ID-NONE-NONE-NONE-NONE-NONE - 61519 activity.windows.com 443 1 IW_comp 5.0 - - - - - - - - - - - - - - - - - IW_comp - "Computers and Internet" "Unknown" "Unknown" - - 0.00 0 - - - - - - - - - - - - - "SGPlatform 2.0" 21040
... View more
Labels
- Labels:
-
using Splunk Enterprise
01-18-2023
09:38 PM
Hi, Thank you for your guidance. Issue is resolved.
... View more
01-02-2023
04:54 AM
Antibot related logs are not appearing in the datamodel results when I run a search query using below datamodel based. Could you please guide me how to fix this issue. Thank you.
| from datamodel:"Intrusion_Detection".AntiBot | search Gateway=xxxxxx
But when I run a search query using below index based, logs are able to see it.
index=checkpoint product=Anti-Bot signature!="" severity IN (High, critical) confidence_level=low
Below is the sample log line.
time=1672655849|hostname=xxxx|severity=High|confidence_level=Low|product=Anti-Bot|action=Detect|ifdir=outbound|ifname=eth3|loguid={0x5127e871,0xbd548381,0xe17d3047,0x8b1277fc}|origin=x.x.x.x|originsicname=CN\=XXXXX,O\=XXXXXX|sequencenum=11|time=1672655849|version=5|dns_message_type=Query|dst=X.X.X.X|lastupdatetime=1672658788|log_id=2|malware_action=Trying to locate a C&C|malware_rule_id={XXXXX}|malware_rule_name=Anti-Bot Prevent Mode|policy=XXXX|policy_time=1668791496|protection_id=XXX|protection_name=XXXXX|protection_type=DNS reputation|proto=17|question_rdata=XXX|received_bytes=0|resource=technetium.network|rule_name=XXX|rule_uid=XXXX|s_port=53361|scope=x.x.x.x|sent_bytes=0|service=xx|session_id={0x63b26e99,0x11,0x5f17f465,0xc5683bca}|smartdefense_profile=XXXX Standard Anti-bot - Prevent|src=x.x.x.x|suppressed_logs=10|tid=57558|layer_name=IPS|layer_name=IPS|layer_name=IPS|layer_uuid={xxxx}|layer_uuid={xxxx}|layer_uuid={xxxx}|layer_uuid={xxx}|layer_uuid={xxxx}|layer_uuid={xxxx}|malware_rule_id={xxxxx}|malware_rule_id={xxxxx}|malware_rule_id={xxxxx}|malware_rule_id={xxxxx}|malware_rule_id={xxxxx}|malware_rule_id={xxxxx}|malware_rule_name=IPS - Prevent Profile|malware_rule_name=Anti-Bot Prevent Mode|malware_rule_name=IPS - Prevent Profile|malware_rule_name=Anti-Bot Prevent Mode|malware_rule_name=IPS - Prevent Profile|malware_rule_name=Anti-Bot Prevent Mode|smartdefense_profile=XXXX Standard IPS - Prevent|smartdefense_profile=XXX Standard Anti-bot - Prevent|smartdefense_profile=xxxxx Standard IPS - Prevent|smartdefense_profile=xxxxx Standard Anti-bot - Prevent|smartdefense_profile=xxxxx Standard IPS - Prevent|smartdefense_profile=xxxxx Standard Anti-bot - Prevent
... View more
Labels
- Labels:
-
configuration
12-26-2022
12:12 AM
Hi, Thank you for your reply. I would like to have double check that, below regex to be included in the add on(Splunk_TA_MS_Security) or in the CIM addon. The logs are being onboarding by using the add on Splunk_TA_MS_Security, so I bit confused where exactly regex requires either in Splunk_TA_MS_Security or Splunk Common Information Model addon. Could you please support for the above query. Thank you.
... View more
12-22-2022
07:13 AM
Hi Rich, Thank you for answer. When I run the regex for both file name and file path in the search extraction is happening. But extraction is not happening in the Endpoint data model. Can you please help me if any changes are required in the regex for Endpoint datamodel.
... View more
12-21-2022
06:45 AM
Hi,
I'm new to the regex, can someone please help me in regex to extract file name and file path separately in the data model.
Field value is variable in the fields file name and file path. Thank you.
Below is the sample data.
"evidence": [{"entityType": "File", "evidenceCreation Time": "2022-12-19T10:43:56.51Z", "sha1": "336466254f9fe9b5a09f27848317525481dd5dd6", "sha256": "59de220b8d7961086e8d2d1fde61b71a810a32f78a9175f1f87ecacd692b85c9", "fileName": "Nero-8.1.1.0b_fra_trial.exe", "filePath": "F:\\Desktop new backup\\Musique \\Nero 8", "processId": null, "process CommandLine": null, "processCreation Time": null, "parentProcessId":
... View more
Labels
- Labels:
-
using Splunk Enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-23-2023
01:52 AM
|
