I am running into an issue with the add-on "Fuzzy search for splunk", I am trying to use it to find malicious process names that are similar to a legitimate one, the issue I have is that the add-on can't seem to parse through hyphens and spaces. The below search will give me a 100% match with "legit-unique-services.exe" and "legit unique services.exe". There is a number of legitimate processes that are like this.
| fuzzy wordlist="services.exe" compare_field=process_name
Is there anything I can do to fix this? Or does the add-on have to be updated to handle this?
... View more