Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rtalcik
rtalcik
Path Finder
Member since:
01-09-2020
04-07-2022
Community Statistics
| Posts | 31 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-09-2020 |
Activity Feed
- Posted Drop Windows Event Logs with EventID 5156 and not RFC 1918 on Getting Data In. 10-22-2021 09:17 AM
- Posted Tailor inputs.conf to match specific windows hosts AND mointor a specific file path on Getting Data In. 12-08-2020 02:39 PM
- Posted Re: SA-geodistance old location time on All Apps and Add-ons. 05-12-2020 08:33 AM
- Posted SA-geodistance old location time on All Apps and Add-ons. 05-12-2020 07:45 AM
- Tagged SA-geodistance old location time on All Apps and Add-ons. 05-12-2020 07:45 AM
- Tagged SA-geodistance old location time on All Apps and Add-ons. 05-12-2020 07:45 AM
- Posted Re: concat lookups for a search on Splunk Search. 04-28-2020 08:29 AM
- Posted Re: concat lookups for a search on Splunk Search. 04-27-2020 06:44 AM
- Posted Re: concat lookups for a search on Splunk Search. 04-27-2020 05:52 AM
- Posted concat lookups for a search on Splunk Search. 04-24-2020 04:24 PM
- Tagged concat lookups for a search on Splunk Search. 04-24-2020 04:24 PM
- Tagged concat lookups for a search on Splunk Search. 04-24-2020 04:24 PM
- Tagged concat lookups for a search on Splunk Search. 04-24-2020 04:24 PM
- Posted Clustered search heads broke lookup tables where do I reupload the lookups? on Splunk Search. 04-21-2020 02:01 PM
- Tagged Clustered search heads broke lookup tables where do I reupload the lookups? on Splunk Search. 04-21-2020 02:01 PM
- Tagged Clustered search heads broke lookup tables where do I reupload the lookups? on Splunk Search. 04-21-2020 02:01 PM
- Posted Re: tstats isn't displaying search on Splunk Enterprise Security. 04-01-2020 08:04 AM
- Posted Re: tstats isn't displaying search on Splunk Enterprise Security. 04-01-2020 08:03 AM
- Posted tstats isn't displaying search on Splunk Enterprise Security. 04-01-2020 06:48 AM
- Tagged tstats isn't displaying search on Splunk Enterprise Security. 04-01-2020 06:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-22-2021
09:17 AM
HI All, So i wrote this in attempt to reject all RFC1918 TO RFC1918 logs for windows event logs with WID 5156. basically log anything external but not internal to internal communication. The sample log is a sniplet of what i am trying to drop. Props.conf [WinEventLog:Security]
TRANSFORMS-sec = WinEventCode5156Drop,WinEventCodeSecDrop,WinEventCodeSecPass Transforms.conf (Is order of operations my issue here?) [WinEventCode5156Drop]
REGEX=((EventCode(?:\S+)5156)[\s\S]*(((((?:Source Address|Destination Address)(?:\S+))(?:\s)+10\.))|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.1[6-9])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.2[0-9])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.3[0-1])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+127\.0\.0\.1)|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+192\.168))[\s\S]*((((?:Source Address|Destination Address)(?:\S+))(?:\s)+10\.)|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.1[6-9])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.2[0-9])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.3[0-1])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+127\.0\.0\.1)|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+192\.168)))
DEST_KEY = queue
FORMAT = nullQueue
[WinEventCodeSecDrop]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[WinEventCodeSecPass]
REGEX=(?:^EventCode=|<EventID>)(4618|4649|4719|4765|4766|4794|4897|4964|5124|550|1102|4621|4675|4692|4693|4706|4713|4714|4715|4716|4724|4727|4735|4737|4739|4754|4755|4764|4764|480|4816|4865|4866|4867|4868|4870|4882|4885|4890|4892|4896|4906|4907|4908|4912|4960|4961|4962|4963|4965|4976|4977|4978|4983|4984|5027|5028|5029|5030|5035|5037|5038|5120|5121|5122|5123|5376|5377|5453|5480|5483|5484|5485|6145|6273|6274|6275|6276|6277|6278|6279|6280|640|619|24586|24592|24593|2454|4608|4609|4610|4611|4612|4614|4615|4616|4622|4624|4625|4634|4646|4647|4648|4650|4651|4652|4653|4654|4655|4656|4657|4658|4659|4660|4661|4662|4663|4664|4665|4666|4667|4668|4670|4671|4672|4673|4674|4688|4689|4690|4691|4694|4695|4696|4697|4698|4699|4700|4701|4702|4704|4705|4707|4709|4710|4711|712|4717|4718|4720|4722|4723|4725|4726|4728|4729|4730|4731|4732|4733|4734|4738|4740|4741|4742|4743|4744|4745|4746|4747|4748|4749|4750|4751|4752|473|4756|4757|4758|4759|4760|4761|4762|4767|4768|4769|4770|4771|4772|4774|4775|4776|4777|4778|4779|4781|4782|4783|4784|4785|4786|4787|4788|4789|4790|4793|4800|4801|4802|4803|4864|4869|4871|4872|4873|4874|4875|4876|4877|4878|4879|4880|4881|4883|4884|4886|4887|4888|4889|4891|4893|4894|4895|4898|902|4904|4905|4909|4910|4928|4929|4930|4931|4932|4933|4934|4935|4936|4937|4944|4945|4946|4947|4948|4949|4950|4951|4952|4953|4954|4956|4957|4958|499|4980|4981|4982|4985|5024|5025|5031|5032|5033|5034|5039|5040|5041|5042|5043|5044|5045|5046|5047|5048|5050|5051|5056|5057|5058|5059|5060|5061|5062|5063|5064|5065|5066|5067|5068|5069|5070|5125|5126|5127|5136|5137|5138|5139|5140|5141|5152|5153|5154|5155|5156|5157|5158|5159|5378|5440|5441|5442|443|5444|5446|5447|5448|5449|5450|5451|5452|5456|5457|5458|5459|5460|5461|5462|5463|5464|5465|5466|5467|5468|5471|5472|5473|5474|5477|5479|5632|5633|5712|5888|5889|5890|608|6144|6272|561|563|625|613|614|615|616|24577|24578|24579|24580|24581|24582|24583|24584|24588|24595|24621|5049|5478)
DEST_KEY = queue
FORMAT = indexQueue I can't figure out why this isn't working. Sample Log 10/21/2021 10:06:05 AM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5156
EventType=0
Type=Information
ComputerName= (REDACTED BY ME THE POSTER)
TaskCategory=Filtering Platform Connection
OpCode=Info
RecordNumber=7865970185
Keywords=Audit Success
Message=The Windows Filtering Platform has permitted a connection.
Application Information:
Process ID: 1548
Application Name: \device\harddiskvolume4\windows\system32\dns.exe
Network Information:
Direction: Inbound
Source Address: 10.10.211.7
Source Port: 53
Destination Address: 10.1.0.0
Destination Port: 57834
Protocol: 17
Filter Information:
Filter Run-Time ID: 90427
Layer Name: Receive/Accept
Layer Run-Time ID: 44
... View more
Labels
- Labels:
-
props.conf
-
sourcetype
-
transforms.conf
-
Windows
12-08-2020
02:39 PM
is it possibly to edit my Monitors:// to work with specific hostnames (Computer Names) and monitor a specific file location for those hostnames only? I will be editing the UF on a Domain Controller, so there will be multiple hostnames checking in and I just want to monitor a specific file path for specific hostnames and not for others on that Domain Controller
... View more
Labels
- Labels:
-
inputs.conf
-
monitor
-
universal forwarder
-
Windows
05-12-2020
08:33 AM
thanks for the post. question though. I understand its using the first event for that pair. but how can I get the time of that first event.
for example im trying to accomplish a vpn alert showing they logged into something over 200 miles away from the last 15 minutes.
If the first IP they're gathering is older than the amount of time it takes to travel over 200 miles than it could produce FPs
... View more
05-12-2020
07:45 AM
Hi all,
so i started using this APP here. - SA-geodistance and its nice, I like it. However I don't understand how it pulls the old location and how I get the time the of the old location it is pulling.
https://splunkbase.splunk.com/app/3232/ OR https://github.com/seunomosowon/SA-geodistance
... View more
04-24-2020
04:24 PM
so in this search the full list is everything in zone A. do is everything in zone b, zoneserialnumbers are a list of serial numbers.
the goal is to say everything in do is in both zoneserial and fulla_list
| inputlookup fullA_list
| join [ | inputlookup zonesserialnumbers ]
| join SerialNumber type=outer [ | inputlookup do | rename serialNo as SerialNumber ]
| search in_do=yes Location=$location$
| fillnull value="No" in_do
| fillnull value="No" Owned
| fillnull value="No" In_full
| chart count by Owned
CSV details
do
deviceName | in_do | location | serialNo | uuid
| Yes | AAAA-AAA |AAAAAAAAAAA | AKAAIFKA112844921-129892184-19129
zoneserialnumbers csv
ProductName | SerialNumber | Owned
Numbers and letters | AAAAA1234AAAA | Yes
FullA_list csv
ComputerName | In_A_list | Location | SerialNumber | UDID
AAAAA-AAAAA | Yes | Country | AAAA1234AAA | AAAAAAAAAAAAAAAA-1234-AAAAAAAA
... View more
04-21-2020
02:01 PM
Hi All,
so i clustered my search heads and added them to my index cluster. However it broke all my lookup tables. I took a backup of /opt/splunk/etc before I did this on the search head with all the lookups.
I guess my question is, is this as simple as just pasting the old lookups into the lookup /system/lookups/
IF SO, where do i do this on? the mgmt_uri? or the captain search head?
if not? can you paste a doc to follow?
... View more
04-01-2020
08:03 AM
Its a custom made field. So probably at search time.... is there a way around this
... View more
04-01-2020
06:48 AM
| tstats count where index=proxy AND sourcetype=dns earliest=-7d by _time, ComputerName span=1h
| xyseries _time, ComputerName, count
So this is an actual field with an actual value and it isnt loading into the search, any reason why?
... View more
03-31-2020
12:32 PM
How do I go about editing the data have the data from umbrella dns logs update the network resolution dns data model
... View more
03-29-2020
07:32 PM
So, what this is doing is it is searching all the events that happened and that it matches. I need to match the latest event so it only triggers an alert.
I also need to add more to it as well such as
index=proxy domain=* OR index=network* src_ip=* dest_ip=*
[| inputlookup test
| stats values(emotet_domain) as query, values(emotet_ip) as IP
|format]
| lookup test emotet_domain as domain OUTPUT emotet_domain
| lookup test emotet_ip as dest_ip OUTPUT emotet_ip
| lookup test emotet_ip as src_ip OUTPUT emotet_ip
will this work??
... View more
03-29-2020
05:08 PM
Thanks this would def help in the future, unfortunately what was below will help even better.
... View more
03-27-2020
12:22 PM
index=proxy domain=*
| rename domain as emotet_domain
| where
[| inputlookup test
| fields emotet_domain]
| stats values(emotet_domain) as emotetDomain
so inside the lookup list i want to be able to match for example a threat of -- reason.com OR www.reason.com
i added the matchtype option of WILDCARD(emotet_domain) AND I have also tried WILDCARD(domain) I am not sure whihc one will help wildcard it, but as of right now it is NOT working.
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
lookup
03-27-2020
08:12 AM
i posted -- i always have an issue with your method.
... View more
03-27-2020
08:08 AM
thanks for answering -- however I ALWAYS have this this problem when i do it that way
Last 24 hours
Error in 'lookup' command: Must specify one or more lookup fields.
The search job has failed due to an error. You may be able view the job in the Job Inspector.
and it is specifying a field in the lookup table
... View more
03-26-2020
01:32 PM
What my search is trying to do is whenever the search matches an item in the lookup list it should display the results which I can turn into an alert. however, it is not working or displaying results and I cant figure out why
(index=cisco* OR index=proxy)
dest_ip="" OR domain=""
| rename dest_ip as emotet_ip
| rename domain as emotet_domain
| where
[| inputlookup emotet-lookup
| fields emotet_ip , emotet_domain]
| stats values(emotet_ip) as emotetIP, values(emotet_domain) as emotetDomain
... View more
03-16-2020
01:56 PM
So i fixed this issue but investigating the errors in splunkd logs like manjuanthemeti said above.
This was resolved by finding out what the issue was and removing empty log files in the directory.
... View more
03-16-2020
11:03 AM
permissions seem fine. they all have root accesss rw both ways
... View more
03-16-2020
10:45 AM
both have root access
... View more
03-16-2020
10:31 AM
very good point I will do.
... View more
03-16-2020
10:09 AM
So I have a seperate folder that was prebuilt from splunk universal forwarder.
The folder path is :
/opt/splunkforwarder/etc/apps/"MY folders HERE"
one of the folders under /apps IS sending
the other folder is not and all it has is a path of
/apps/NOT SENDING FOLDER/local/input.conf
inside inputs.conf I have
[monitor:///var/log/router/.log]
host_regex=router/(.).log
sourcetype=cisco
index=net
crcSalt=
disabled = 0
this is not monitoring the folder and NO logs are going into splunk
however in the correct folder that is sending i have
[monitor:///var/log/security.log]
sourcetype = seclog
index = sec
disabled = 0
I also have the following folders in the correct logs that i do not have in the no working log
default local metadata README.md static
was wondering if anyone can point me in the direction to help me figure out why one folder is sending but the other isnt.
... View more
03-03-2020
10:38 AM
so need some help because it didnt work
sourcetype=cisco*
[| inputlookup EmotetIP.csv
| rename IP as query
| fields query
]
What I am trying to accomplish is basically building the list so I can set up an alert if a Log comes in that matches an IP in this list
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-07-2022
03:57 PM
|
