About henryyiu2degree

henryyiu2degree · ‎01-09-2018

I have tried this and work as well, but the others answer is more accurate. Appreciate your help, thanks a lot.

henryyiu2degree · ‎01-09-2018

This works perfectly, thanks for the help. I have changed a little to use the last subnet as that one is generated by nmap: | rex field=_raw ".*scan\sinitiated\s.*\s(?<subnet>\d+.\d+.\d+.\d+\/\d\d)" | rex field=_raw "\((?<hosts_up>\d+)\shosts\sup\)\sscanned\sin\s(?<duration>\d+).\d\d\sseconds" | transaction startswith=eval(isnotnull(subnet)) endswith=eval(isnotnull(hosts_up)) source | table _time, subnet, hosts_up, duration

henryyiu2degree · ‎01-08-2018

Thanks @mayurr98 for your comment. I afraid there is no common fields in the raw logs but could I join "scan initiated" and the next "Nmap done" together?

henryyiu2degree · ‎01-07-2018

I want to join the nmap scanning results. The common field is the source "nmapscan_1.gnmap" while other scans will have a different source name. Event 1 # Nmap 5.51 scan initiated Tue Dec 11 10:54:16 2017 as: nmap -A -T4 -oA scan_192.168.1.0_24_20171219 192.168.1.0/24 host =nmapserver source =nmapscan_1.gnmap sourcetype =nmap Event 2 # Nmap done at Tue Dec 11 12:20:04 2017 -- 256 IP addresses (81 hosts up) scanned in 5147.70 seconds host =nmapserver source =nmapscan_1.gnmap sourcetype =nmap I want to get the following results: Time, Subnet, #Hosts up, Duration Tue Dec 11 10:54:16 2017, 192.168.1.0/24, 81, 5147.70 Could I use the "source" as a common field and how to do this? Thanks.

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎01-07-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Join 2 events with same "source"

Re: Join 2 events with same "source"

Re: Join 2 events with same "source"

Re: Join 2 events with same "source"

Join 2 events with same "source"