We had an incident on a device that we had not had a chance to ingest logs into Splunk. That incident occurred 2 weeks ago. That device is now feeding logs into Splunk. It ingested the logs on that device that were up to a year old. The problem is, the timeframe that the incident happened, did not trigger any of the ESS out-of-the-box Correlation Searches\Notable events (because the timestamps were outside of the search criteria of the Correlation search). I went to the device and downloaded the logs from the time we started ingesting them into Splunk going back 90 days. I also setup a test index to ingest those logs into Splunk. Issues I am having: 1) How do I get the Correlation Searches to look at data that is 90+ days old? 2) Since a bunch of the out-of-the-box Correlation Searches in ESS utilize the data models, how does that affect how these trigger the alerts with a timestamp that is that far out? End Result: Basically, I am looking to see if any of the Correlation Searches\Notable events that come with ESS would have triggered and alerted on the incident we had. This will tell me whether I need to tune those alerts, or whether I need to create custom Correlation Searches to detect this incident in the future. ... View more

I looked around, but could not find anyone asking this question specifically. Basically, when a notable event triggers, it creates the event_id. Is it possible to tag all logs with that event_id that caused the notable event to fire? Example: If I have a notable event that counts when an FQDN is seen in more than one log within 1hr, it triggers the alert. Let's say it saw the same FQDN in 5 logs within the hour. Is there anyway for those 5 logs then to be tagged with the event_id from the notable event? I ask this for a few reasons: 1) Drill-down searches could be simplified. 2) I could setup a dashboard and email the notable event and the associated logs (by the event_id tag). 3) When performing "hunting", It would be nice to see logs that are already associated with an alert. Would help with correlation. 4) If a log is seen with multiple event_id's, it would help figure out what might be wrong with a notable event, that a notable event might need to be tuned, or locate notable events that fire on the same content. ... View more

We have the Bro add-on installed and everything is being parsed into the proper fields. The Bro DNS logs (sourcetype=bro_dns) have a field called "answers". The value in this field can contain multiple values, all comma delimited (i.e. 10.10.10.1,10.10.10.2,10.10.10.3). I do not have access to the backend (props.conf and transforms.conf) to make the proper changes in those files. I have tried multiple times through the UI via a Transformation field, but nothing I seem to do creates a new multivalue field (new field would be "dns_answers"). I figured this would work, but it doesn't: Regular expression: ( \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) Format: dns_answers::$1 Source Key: answers Multivalue check box is checked. What am I doing wrong? ... View more

In the default ES data model "Malware", the "tag" field is extracted for the parent "Malware_Attacks", but it does not contain any values (not even the default "malware" or "attack" used in the "Constraints". They are, however, found in the "tag" field under the children "Allowed_Malware", "Blocked_Malware", and "Quarantined_Malware". In IR, there is a correlation search ("Host With A Recurring Malware Infection"). I created an event type and tag for tagging certain software as "approved_software". It is working and showing in the "tag" field under the 3 children above. The correlation search does not work with calling out the field "Malware_Attacks.tag" as there are no values in this field. I am trying to use "nodename" to call all three of the above children datasets, but I am not sure how to call the individual field "tag" in each of them. Below is the furthest I have gotten where the search works. How do I call the individual fields (i.e. "Allowed_Malware.tag", or "Blocked_Malware.tag") so I can exclude those with a tag "approved_software"? | tstats summariesonly=true allow_old_summaries=true dc(Malware_Attacks.date) as "day_count",count from datamodel=Malware.Malware_Attacks where nodename=Malware_Attacks.Allowed_Malware by "Malware_Attacks.dest","Malware_Attacks.signature" ... View more

In the logs for "New Anti Virus", the logs contain a "dst=" and "src=" field. For some logs, it is placing the "dst=" value into both the dst and the src fields. In other logs, it is placing the "dst=" value into the src field, and the "src=" value into the dst field. In other logs, it is putting the "dst=" value into both fields, but these logs then have the dest, dest_ip, and src_ip fields that contain the wrong values. Examples for the "New Anti Virus" logs: Log type 1 log contains dst=10.20.30.40; dst field contains 10.20.30.40 log contains src=50.60.70.80; src field contains 10.20.30.40 Log type 2 log contains dst=10.20.30.40; dst field contains 50.60.70.80 log contains src=50.60.70.80; src field contains 10.20.30.40 Log type 3 log contains dst=10.20.30.40; dst field contains 10.20.30.40, dest field contains 50.60.70.80, dest_ip=50.60.70.80 log contains src=50.60.70.80; src field contains 10.20.30.40, src_ip field contains 10.20.30.40 Is there anyway to fix this? ... View more

In the Threat Activity Detected IR correlation search, it calls for stuff from the "Threat Intelligence" Data Model. As an example, an IP has been found to be malicious, and it only reports on DNS logs within my environment. What do I need to do to the "IP Intel" Dataset to have it include logs from my firewall? Would I just need to add "index=checkpoint sourcetype=opsec" to the current base search for "IP Intel"? What I am trying to accomplish is to have the results not only show the DNS logs for that IP, but also include the firewall logs. This way I can have the alert only fire when it sees DNS and a connection outbound to that IP. Any help would be greatly appreciated. ... View more

I have an analyst that was playing around trying to extract a new field. Unfortunately, he used the delimiter function and instead of backing out of it, he saved it. So on top of the normal fields being parsed out, I have over 60 fields called field1, field2, field3, etc. How can I go about removing these? Also, a second part to this question, I have bro_http logs coming in and the contain a "version" field. This field is not being parsed out, instead, everything being parsed out has shifted to the left by one field (i.e. instead of version being 1.1, the version is showing the user_agent information, which should be in the user_agent field one field to the right)? What file can I update to ensure it is parsing out the version? ... View more