Alerting

Correlation in Splunk Enterprise

kenneth_wong
New Member

Hi Guys,

I am new to Splunk Enterprise. I am currently setting up a testlab to do correlation event for a simulation attack (from Kali Linux) on an Apache Web Server (with ModSecurity installed). As I am trying to correlation two source types: one from Firewall and one from ModSecurity so that upon an attack attempt from Kali Linux(Attacker) will auto trigger an alert. I would like to understand whether it is possible to achieve this correlation event alert without Splunk Enteprise Security.

Your help is very much appreciated.

Thanks.

Regards,
Kenneth

Tags (1)
0 Karma
1 Solution

jpolcari
Communicator

This is definitely possible without ES. There are a few options for correlating data within Splunk:

-Using the transactioncommand: http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction
-Using a sub search: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchTutorial/Useasubsearch
-Using a lookup: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup

Depending on what exactly you are trying to correlate (IPs, etc), you should be able to use one of those methods to correlate between the firewall and ModSecurity.

View solution in original post

0 Karma

kenneth_wong
New Member

Hi jpolcari

Thanks for your enlightenment. I managed to address my concern with join command where I can correlate the events from both two different data sources with same fieldname of source IP and destination port.

My search command is as follows that I would like to share:

sourcetype="sophos:utm:firewall" srcip=* dstport=80 | join srcip dstport [search sourcetype="modsec_audit"|rename SRC as srcip DPT as dstport]

Thanks.

Regards,
Kenneth

0 Karma

jpolcari
Communicator

This is definitely possible without ES. There are a few options for correlating data within Splunk:

-Using the transactioncommand: http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction
-Using a sub search: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchTutorial/Useasubsearch
-Using a lookup: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup

Depending on what exactly you are trying to correlate (IPs, etc), you should be able to use one of those methods to correlate between the firewall and ModSecurity.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...