Hi.
for example, i have that log:
Apr 26 12:04:38 centos7LAB sudo: qweqwe : TTY=pts/4 ; PWD=/home/qweqwe ; USER=root ; COMMAND=/bin/chmod +x 436346
and i want to make filter by command by lookup
kinda sourcetype=sudo | stats count by host _time src_user src TTY PWD USER dest COMMAND action | lookup suspicious_commands COMMAND AS COMMAND OUTPUT COMMAND AS COMMAND | where COMMAND!="" | sort - _time
I used match_type = WILDCARD(COMMAND)
my lookup look like it:
COMMAND
*chmod*
Open my screenshot and instead of *chmod*
I want see /bin/chmod +x 436346
Or what you know other solutions to make what I want?
Is the lookup only used as a list of things to search for? If yes, you can try using a query like this instead
sourcetype=sudo [| inputlookup suspicious_commands ] | stats count by host _time src_user src TTY PWD USER dest COMMAND action | sort - _time
Is the lookup only used as a list of things to search for? If yes, you can try using a query like this instead
sourcetype=sudo [| inputlookup suspicious_commands ] | stats count by host _time src_user src TTY PWD USER dest COMMAND action | sort - _time
It works! Thank you!
Will be nice if you will explain a bit why it works, cause i have some triggers in my head.
So when a subsearch is used in a search command (and the search command is by default the first command of a query), the subsearch expands it's results into additional search terms, where the fields of a row/event are combined with "AND" and multiple rows/events are combined with "OR".
So if you have a lookup like
COMMAND
*chmod*
*chown*
then [| inputlookup suspicious_commands]
will expand into ( (COMMAND="*chmod*") OR (COMMAND="*chown*") )
.
You can actually see what exactly something would expand to by using the format
command, like | inputlookup suspicious_commands| format
. And you can use pretty much anything for the subsearch, not just lookups.
Do
lookup suspicious_commands COMMAND OUTPUT COMMAND AS cmd_match | where isnotnull(cmd_match) | fields - cmd_match
It works, too!
Explain me what you did.
I mean:
lookup suspicious_commands COMMAND OUTPUT COMMAND AS cmd_match
If this isnt going to be a large lookup then yes the inputlookup pattern works. I tend to stick with the normal lookup pattern. Your original search stomped the original command field. This just outputs the field you matched on to it's own name then looks for where it is not null. AKA found a match.