About jlovik

jlovik · ‎06-10-2021

For some reason my search is not acting as expected. I am trying to produce a list of systems with the specific isolatedCVE I get from the TOP command. But instead of getting stats count of systems with the isolatedCVE i get just the TOP output still as seen below. It seems like the TOP command somehow trumps the second set of commands and i dont understand why. output for this command = VulnerabilityCVEIDs count percent isolatedCVE CVE-2021-31959 106 29.12 CVE-2021-31959 Full search = | search index=rapid7 sourcetype="vuln_db" | eval Epoch_Time=strptime(VulnerabilityPublishedDate, "%Y-%m-%d") | eval disctime=strftime(_time, "%Y-%m-%d") | eval Addtime=strftime(Epoch_Time + (30 * 86400), "%Y-%m-%d") | where VulnerabilityTitle LIKE "Microsoft%" AND Addtime > disctime | top VulnerabilityCVEIDs limit=1 | eval isolatedCVE=VulnerabilityCVEIDs | appendcols [| search index=rapid7 sourcetype="vuln_db" VulnerabilityCVEIDs=isolatedCVE | dedup AssetNames | dedup AssetIPAddress | stats count by AssetIPAddress AssetNames User VulnerabilityCVEIDs | fields - count]

jlovik · ‎03-25-2021

Is there a way to remove any day where the specific event count is 0? I would like to remove any day where the logs did not import. The days with events 0 are throwing off my averages.

jlovik · ‎05-27-2020

Ok so my data is coming from a vulnerability management system. every day i get a dump of every vulnerability in the system. Each unique vulnerability on every asset is given a UniqueAssetVulnID. That id is specific to that vulnerability on that asset day over day. Now I would like to identify when a vulnerability has been remediated IE appeared on yesterdays scan but not on todays scan by Category which is just the severity. This would all be plotted on a area chart. Sample data would be like _time Category UniqueAssetVulnID 05/26/2020 Low 1249+cve-2020-3948 05/27/2020 High 5239+cve-2010-4533 index=rapid7 sourcetype="VulnData" | streamstats current=f last(dc(UniqueAssetVulnID)) as UniqueVulnslast_count by Category | rename UniqueAssetVulnID as current_UniqueAssetVuln | eval delta = UniqueVulnslast_count - current_UniqueAssetVuln | timechart span=1d delta by Category useother=f

jlovik · ‎05-05-2020

Expected output would be just what you mentioned. but instead of getting that i just get 1 date and 0s for critical high low moderate. I suspect it is translating _time back to the event inject time and not the VulnerabilityPublishedDate like i set it to.

jlovik · ‎05-05-2020

@richgalloway for whatever reason this still produces nothing. That is what has me all mixed up. Below i put the whole query in case i am doing something foolish higher up in my stack. output: _time Critical High Low Moderate 2020-05-05 Full Query: index=vuns sourcetype="vulndb" earliest=-12h latest=now | eval Epoch_Time=strptime(VulnerabilityPublishedDate, "%Y-%m-%d") | eval disctime=strftime(_time, "%Y-%m-%d") | eval Addtime=strftime(Epoch_Time + (30 * 86400), "%Y-%m-%d") | where Addtime > disctime | eval newtime=strftime(Epoch_Time, "%Y-%m-%d") | eval _time=newtime | stats dc(VulnID) as UniqueVulns by Category _time | timechart span=1d values(UniqueVulns) by Category

jlovik · ‎05-05-2020

I am getting the following data from a stats command. How would i translate this into a timechart? when i do try and add a time chart after manipulating a second date field into _time i get no more data. The stats command give me the data i need i just need help formatting it day over day with vulnID totals broken down by Category. Have tried: | timechart span=1d dc(VulnID) by Category output is blank for this timechart. Stats command: | stats dc(VulnID) by Category _time Category _time dc(VulnID) Critical 2020-04-14 53 High 2020-04-07 424 High 2020-04-08 4 High 2020-04-09 34 High 2020-04-13 138 High 2020-04-14 4427 High 2020-04-15 719 High 2020-04-16 5416 High 2020-04-22 6 Low 2020-04-06 1 Low 2020-04-07 926 Low 2020-04-08 2 Low 2020-04-09 11 Low 2020-04-13 3364 Low 2020-04-14 89049 Low 2020-04-15 443

jlovik · ‎05-05-2020

you are magic. thank you!

jlovik · ‎05-05-2020

your search works perfectly from above. i get the below all neatly aligned. it just doesn't seem to let me create a chart out of those fields after the | streamstats command. I would like to chart the tops 1-10 for each import_timeday for my search range in a line chart. timeday, VulnerabilityTitle, Count tops, 2020-05-04, Weak LAN, 1 2020-05-02, VM Ware, 1 2020-05-05, tls, 1 2020-05-01, micro, 1

jlovik · ‎05-05-2020

@magneto417x This is not a quiz. It's a real world problem im working on. i am just very new to splunk. So if i wanted to rank these over time in a timechart (i know i previously asked for the opposite) how would i do that? This seems like it should work to me. | eval import_time=strftime(_time, "%Y-%m-%d:%H") | eval import_timeday=strftime(_time, "%Y-%m-%d") | eventstats latest(import_time) as Last by import_timeday | where Last = import_time | stats count as Count by import_timeday VulnerabilityTitle | sort 0 - Count | streamstats count as tops by import_timeday | timechart span=1d count by VulnerabilityTitle where tops < 11

jlovik · ‎05-04-2020

Ok so bear with me as I explain. I would like to view my VulnerabilityTitle count deltas over time. So for instance, if I ran count by VulnerabilityTitle yesterday to get my top 10 most common vulnerabilities in my environment that is great. however, I need to be able to do that day after day using a time range. So, for instance, my top most common VulnerabilityTitle may drop down to my second most common VulnerabilityTitle after patching over the weekend. So my end goal is to be able to pick a time window and get VulnerabilityTitle counts Ranked for all the days in the time window I pick. That way I can see x vulnerability was rank 1 yesterday and is now rank 2 today. I am currently running this the search below which gives me most of what I want but it does not track the ranking over time. This ideally would not be only viewable in line graph format. | eval import_time=strftime(_time, "%Y-%m-%d:%H") | eval import_timeday=strftime(_time, "%Y-%m-%d") | eventstats latest(import_time) as Last by import_timeday | where Last = import_time | timechart span=1d count by VulnerabilityTitle where max in top10 useother=f

jlovik · ‎03-26-2020

This is exactly what i needed to get it all together. I edited it slightly in the final search for clarity. I also missed the tool tip telling me to use $ on both side of the variable in the dashboard which was one of my issues. | eval Epoch_Time=strptime(VulnerabilityPublishedDate, "%Y-%m-%d") | eval Addtime=strftime(Epoch_Time + (30 * 86400), "%Y-%m-%d") | eval Now = strftime(now(), "%Y-%m-%d") | where Addtime < Now

jlovik · ‎03-25-2020

A am trying to add a contextual input field to my dashboard and I seem to be having a hard time translating it into something splunk understands. The idea is to be able to use a dropdown menu to select between 0, 30, 60, 90 days. At which point all subsequent dashboards will exclude logs that have VulnerabilityPublishedDate earlier than the selection. I originally though i would give the drop down a token say $datemodifier$ and then add the below logic to each of my dashboards query's. But this does not seem to work In the dashboard i tried this. | eval OffsetTime = strftime(relative_time(now(),"-$datemodifier$d@d"), "%Y-%m-%d") This is my search index=stuff sourcetype="stuff" | eval Epoch_Time=strptime(VulnerabilityPublishedDate, "%Y-%m-%d") | eval stripTime=strftime(Epoch_Time, "%Y-%m-%d") | eval OffsetTime = strftime(relative_time(now(),"-30d@d"), "%Y-%m-%d") | where stripTime <= OffsetTime | table Epoch_Time stripTime VulnerabilityPublishedDate OffsetTime Sample output from this search: 1583798400.000000 2020-03-10 2020-03-10 00:00:00.0 2020-03-25 1583798400.000000 2020-03-10 2020-03-10 00:00:00.0 2020-03-25 1583798400.000000 2020-03-10 2020-03-10 00:00:00.0 2020-03-25 1583798400.000000 2020-03-10 2020-03-10 00:00:00.0 2020-03-25 1583798400.000000 2020-03-10 2020-03-10 00:00:00.0 2020-03-25 1583798400.000000 2020-03-10 2020-03-10 00:00:00.0 2020-03-25 1583798400.000000 2020-03-10 2020-03-10 00:00:00.0 2020-03-25 1583798400.000000 2020-03-10 2020-03-10 00:00:00.0 2020-03-25 1583798400.000000 2020-03-10 2020-03-10 00:00:00.0 2020-03-25

Posts	12
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎03-25-2020

Online Status	Offline
Date Last Visited	‎06-10-2021 01:45 PM

Storing top result as variable then displaying sys...

Vulnerabilities remediation over time

Getting output of stats command to work in timecha...

How to view my VulnerabilityTitle count deltas ove...

Adding date range modifiers to dashboard input

Storing top result as variable then displaying sys...

Re: how do I get daily average over a month for al...

Vulnerabilities remediation over time

Re: Getting output of stats command to work in tim...

Re: Getting output of stats command to work in tim...

Getting output of stats command to work in timecha...

Re: How to view my VulnerabilityTitle count deltas...

Re: How to view my VulnerabilityTitle count deltas...

Re: How to view my VulnerabilityTitle count deltas...

How to view my VulnerabilityTitle count deltas ove...

Re: Adding date range modifiers to dashboard input

Adding date range modifiers to dashboard input