Alerting

Correlation in Splunk Enterprise

kenneth_wong
New Member

Hi Guys,

I am new to Splunk Enterprise. I am currently setting up a testlab to do correlation event for a simulation attack (from Kali Linux) on an Apache Web Server (with ModSecurity installed). As I am trying to correlation two source types: one from Firewall and one from ModSecurity so that upon an attack attempt from Kali Linux(Attacker) will auto trigger an alert. I would like to understand whether it is possible to achieve this correlation event alert without Splunk Enteprise Security.

Your help is very much appreciated.

Thanks.

Regards,
Kenneth

Tags (1)
0 Karma
1 Solution

jpolcari
Communicator

This is definitely possible without ES. There are a few options for correlating data within Splunk:

-Using the transactioncommand: http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction
-Using a sub search: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchTutorial/Useasubsearch
-Using a lookup: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup

Depending on what exactly you are trying to correlate (IPs, etc), you should be able to use one of those methods to correlate between the firewall and ModSecurity.

View solution in original post

0 Karma

kenneth_wong
New Member

Hi jpolcari

Thanks for your enlightenment. I managed to address my concern with join command where I can correlate the events from both two different data sources with same fieldname of source IP and destination port.

My search command is as follows that I would like to share:

sourcetype="sophos:utm:firewall" srcip=* dstport=80 | join srcip dstport [search sourcetype="modsec_audit"|rename SRC as srcip DPT as dstport]

Thanks.

Regards,
Kenneth

0 Karma

jpolcari
Communicator

This is definitely possible without ES. There are a few options for correlating data within Splunk:

-Using the transactioncommand: http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction
-Using a sub search: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchTutorial/Useasubsearch
-Using a lookup: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup

Depending on what exactly you are trying to correlate (IPs, etc), you should be able to use one of those methods to correlate between the firewall and ModSecurity.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...