I want to make a usecase that will detect the usage of several destination port numbers. For this, I think it's easiest to use a regular expression. But I'm not sure. I'm also having trouble implementing a regular expression into my query. I've never worked with them before. Please evaluate the following information and tell me what you think is best to develop the query. The usecase must be easy to add or remove any port numbers from, in case we want to detect other things. The usecase must be able to detect ranges of port numbers when indicated. Now, for what I've tried is the following: index=network | regex dest_port>="688[1-9]" But this doesn't work. I will use datamodel later. The range for the ports is: 6881 to 6889 6969 In addition to those ports, we also want it to alert when it finds the following strings in the field app_category: app_category field contains tracker app_category field contains torrent Any help would be much appreciated. I think someone with a lot of regular expression experience will be able to make the query easily, I've been stuck on it for hours sadly and I would love some help. Thanks! ... View more

I want to use inputlookup to search only a certain set of hosts. These are in a .csv file. I have the query and it's all fine but it's returning results from EVERY host, not just the ones on the list. How can I fix this? index="wineventlog*" CategoryString="Logon/Logoff Event" [ inputlookup lars_file_computers_zonder_human_inlog.csv | return 115 Workstation_Name=$src ] | table Workstation_Name, src, app, action, user ... View more

I'm trying to make a usecase where it will alert when there are several attempts of failed logins and one of them succeeded in the past 10 minutes. So it must do the following thing: Alert when 10 failed logins are followed up by 1 successful log-in in the past 10 minutes. Is there a possible way to do this? I'm currently using a query of a datamodel that shows all logins in the timeframe given to the search. The query: | tstats summariesonly=true count from datamodel=Authentication by _time, "Authentication.src_user", "Authentication.action" | search (Authentication.src_user!="NULL SID" AND NOT Authentication.src_user="-" AND NOT Authentication.src_user="unknown") Thanks in advance everyone ... View more

I need to make a report once a month that indicates the trend between the succesful / unsuccesful log-ins on the network. I'm using the authentication data model for this. But when adding a trendline, nothing shows up in the visualization tab. There is only one line. Can anyone tell me what's going wrong? | tstats summariesonly=true count from datamodel=Authentication by "Authentication.action" | search "Authentication.action"!="unknown" | trendline sma5(count) AS trend ... View more

Hello, My dashboard is running very slow and crashes my browser ever since I changed the text box to a multiselect box. This is because it was requested by a coworker who wants to put in multiple values at a time. The search behind the multi value is schedulded once a week, and seems to be running very smoothly. The problem really is the multi select, when you click on it and it drops down, it becomes super slow and you can't click or type anything, it will make your browser unresponsive. The dashboard code: <form> <label>V2 Clone</label> <fieldset submitButton="true"> <input type="text" token="qid_text"> <label>ID</label> <default>*</default> </input> <input type="multiselect" token="cve_id" searchWhenChanged="true"> <label>ID</label> <prefix> "</prefix> <suffix>"</suffix> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>CVE</fieldForLabel> <fieldForValue>CVE</fieldForValue> <search ref="aaaaa_cves"></search> </input> <input type="text" token="vendor_ref"> <label>Vendor Reference</label> <default>*</default> </input> </fieldset> <row> <panel> <table> <search> <query>| inputlookup kb_lookup | eval CVE=split(CVE, ", ") | mvexpand CVE | eval VENDOR_REFERENCE=split(VENDOR_REFERENCE, ", ") | mvexpand VENDOR_REFERENCE | search QID=$qid_text$ CVE=$cve_id$ VENDOR_REFERENCE=$vendor_ref$ | stats list(QID) AS "ID", list(TITLE) AS "Vuln. description", list(CVE) AS "CVE ID", list(SEVERITY) AS "Severity", list(CVSS_BASE) AS "CVSS Base", list(CVSS_TEMPORAL) AS "CVSS Temporal", list(VENDOR_REFERENCE) AS "Vendor Reference"</query> <earliest>-1h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> And the report query: | inputlookup kb_lookup | makemv delim="," CVE | mvexpand CVE | rex field=CVE mode=sed "s/^[\r\n\s]+// s/[\r\n\s]+$//" | search CVE= "*" | dedup CVE | sort 0 - CVE | fields CVE It is set to run over all time on Monday at 8 AM. Any suggestions? I can't figure it out for the life of me. ... View more

Hello, I'm trying to make a dashboard input to use multiple values as input. I don't know how to make the query work properly. I am using eval to expand the values, but how to I use a token and implement it into my search? Here is the query I have now: -snip- This doesn't work, by the way. Does anyone know how to achieve my goal? Thanks in advance! ... View more