Alerting

Correlation in Splunk Enterprise

kenneth_wong
New Member

Hi Guys,

I am new to Splunk Enterprise. I am currently setting up a testlab to do correlation event for a simulation attack (from Kali Linux) on an Apache Web Server (with ModSecurity installed). As I am trying to correlation two source types: one from Firewall and one from ModSecurity so that upon an attack attempt from Kali Linux(Attacker) will auto trigger an alert. I would like to understand whether it is possible to achieve this correlation event alert without Splunk Enteprise Security.

Your help is very much appreciated.

Thanks.

Regards,
Kenneth

Tags (1)
0 Karma
1 Solution

jpolcari
Communicator

This is definitely possible without ES. There are a few options for correlating data within Splunk:

-Using the transactioncommand: http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction
-Using a sub search: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchTutorial/Useasubsearch
-Using a lookup: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup

Depending on what exactly you are trying to correlate (IPs, etc), you should be able to use one of those methods to correlate between the firewall and ModSecurity.

View solution in original post

0 Karma

kenneth_wong
New Member

Hi jpolcari

Thanks for your enlightenment. I managed to address my concern with join command where I can correlate the events from both two different data sources with same fieldname of source IP and destination port.

My search command is as follows that I would like to share:

sourcetype="sophos:utm:firewall" srcip=* dstport=80 | join srcip dstport [search sourcetype="modsec_audit"|rename SRC as srcip DPT as dstport]

Thanks.

Regards,
Kenneth

0 Karma

jpolcari
Communicator

This is definitely possible without ES. There are a few options for correlating data within Splunk:

-Using the transactioncommand: http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction
-Using a sub search: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchTutorial/Useasubsearch
-Using a lookup: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup

Depending on what exactly you are trying to correlate (IPs, etc), you should be able to use one of those methods to correlate between the firewall and ModSecurity.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...