Splunk Search

Compare two lookups, different fields against ES Annotations output

StuartMacL
Path Finder

Hi all,

First of all, I realize this is achievable using Security Essentials, however we have a lot of manually created correlation searches and so need to add them manually - seems more work than creating a new search such as this.

I have two lookup tables; 'MitreFramework.csv' which is a copy-paste of the Mitre Att&ck Matrix from https://attack.mitre.org, and 'mitre_enrichment.csv' which simply contains the technique names and their mitre_ids (fields are named exactly like this.)

I have also annotated all of our correlation searches with their respective Mitre technique ID into up to three columns, export of which in a search shown below.
annotations.jpg

I'm trying to compare the Mitre Technique ID's as above with the mitre_id field in the mitre_enrichment.csv lookup, to then get the corresponding 'technique' name, and then search for that technique field in the 'Mitre Framework.csv' lookup. If it exists, something happens to a table of the Mitre Framework to indicate that is it being covered (even appending a number of 1 to the cell, or only showing the cells which are matched would be okay).

I know... this is a bit complicated, I'm hoping someone with more experience can see the logic and assist. Search for simply exporting the Mitre framework and annotations from the correlation rules is below. 'CHR' is simply part of the naming convention we use for all our rules;

 

| inputlookup MitreFramework.csv
| append
[| rest splunk_server=local count=0 /services/saved/searches
| where disabled!=1
| search action.correlationsearch.label="CHR*"
| rex field="action.correlationsearch.annotations" "^.*attack\":\[\"(?<Mitre1>T\d+)\"]?"
| rex field="action.correlationsearch.annotations" "^.*attack\":\[\"T\d+\",\"(?<Mitre2>T\d+)\""
| rex field="action.correlationsearch.annotations" "^.*attack\":\[\"T\d+\",\"T\d+\",\"(?<Mitre3>T\d+?)\""
| table action.correlationsearch.label Mitre1 Mitre2 Mitre3
| rename action.correlationsearch.label as "Rule Name" Mitre1 as "Mitre Technique 1" Mitre2 as "Mitre Technique 2" Mitre3 as "Mitre Technique 3"]

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...