About LionSplunk

LionSplunk · ‎11-10-2023

Hi Rick, I try to do a dropdown for the status to filter for "still open", "closed" etc. index=nessus Risk=Critical | eval state=if(_time<now()-7*85400,"OLD","NEW") | eval status=case(state="OLD" and state="NEW","still open",state="OLD","closed",state="NEW","Yummy, a fresh one!") and added |stats count by status I get the Information for the 3 status outputs in the normal search. I added this in the dropdown and can choose between the 3 but when i choose one of them i get no result found back. All with * is going. i tried a static options and thats the same problem. i cant filter for the 3 status outputs. Do you know what i am doing wrong? Thanks

LionSplunk · ‎11-07-2023

Hello Pickle Rick, Thanks for your help! It worked!

LionSplunk · ‎10-25-2023

Yes, you are right. Second search is useless. index=nessus Risk=Medium earliest=-9d latest=now | stats values(CVE) as CVE_9d by extracted_Host | eval Status=case(isnull(CVE_9d) AND isnotnull(CVE_now), "New",isnotnull(CVE_9d) AND isnull(CVE_now), "Finished", isnotnull(CVE_9d) AND isnotnull(CVE_now), "Not Changed") | table extracted_Host, Status My Problem is still here. I import vulnerability scans Logs into Splunk and get the Information about which Host has an open CVE and how high critical it is. I want the output if the scanned Host is in the old scan for 7 days and not in the new scan today and get the output that the Host is "Finished", same output for Host if is in the old scan and the new scan then i want the output "Unchanged", same output for Host when it is not in the old scan but in the new scan then i want the output "New" . I need the Information that i can build a Dashboard and see which Host and CVE are "done" , which one are "still open" and which Host and CVE are "New" because i must give the information/Ticket to the Server Admins. Thanks

LionSplunk · ‎10-24-2023

Hello, We are implenting splunk in our environment and right now i import every 7 days our vulnerability scan to splunk. My Task is to filter the Host and the CVE Number and get the output which host and CVE is new in the newest scan "New", which was in the old scan but is not there in the new scan "finished" and which is in both scan and is "unchanged" The Problem is i do not have any information in the log data that the Host is finished or anything else . I have only 4 Fields: CVE ,extracted_Host, RISK Level = Critical,High and Medium and _time of course. Thats my try: index=vulnerability_scan Risk=Critical earliest=-7d latest=now | stats values(CVE) as CVE_7d by extracted_Host | appendcols [ search index=vulnerability_scan Risk=Critical earliest=now -7d latest=now | stats values(CVE) as CVE_now by extracted_Host ] | eval Status=case(isnull(CVE_7d) AND isnotnull(CVE_now), "New", isnotnull(CVE_7d) AND isnull(CVE_now), "Finished", isnotnull(CVE_7d) AND isnotnull(CVE_now), "Not Changed") | table extracted_Host, Status Problem with this i get only the output "finished" but most of the scans are in the old scan means that they are "unchanged". For me It is possible to split out the 3 outputs then i would build a Dashboard with the 3 Informations. I dont know if Splunk is the best tool to compare 2 timestamps like i will do? The Time Range is every time 7 days - maybe in the next time it will be shorter but right now its 7 days. Thanks for the help

LionSplunk · ‎10-18-2023

Thats my filter now and it seems working index=nessus Risk=Critical | transaction CVE, extracted_Host | table CVE, extracted_Host

LionSplunk · ‎10-18-2023

Here is an event log output. Its both the same log only with an other date. I see both event logs in the output in splunk but i dont want see one of them if in the search are two same event logs. Means if i filter for 7 days and there is only one event log with CVE-2023-21554 then i want to see this because its "new" but when i filter for 30 days and then i find two equal eventlogs i dont want to see it in the output because its not new - right now i see it 16/10/2023 04:00:03.000 "175373","CVE-2023-21554","10.0","Critical","10.56.93.133","tcp","1801","Microsoft Message Queuing RCE (CVE-2023-21554, QueueJumper)","A message queuing application is affected a remote code execution vulnerability.","The Microsoft Message Queuing running on the remote host is affected by a remote code execution vulnerability. An unauthenticated remote attacker can exploit this, via a specially crafted message, to execute arbitrary code on the remote host.","Apply updates in accordance with the vendor advisory.","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21554 http://www.nessus.org/u?383fb650","Nessus was able to detect the issue by sending a specially crafted message to remote TCP port 1801." CVE = CVE-2023-21554 Risk = Critical extracted_Host = 192.168.0.1 sourcetype = csv 09/10/2023 04:00:03.000 "175373","CVE-2023-21554","10.0","Critical","10.56.93.133","tcp","1801","Microsoft Message Queuing RCE (CVE-2023-21554, QueueJumper)","A message queuing application is affected a remote code execution vulnerability.","The Microsoft Message Queuing running on the remote host is affected by a remote code execution vulnerability. An unauthenticated remote attacker can exploit this, via a specially crafted message, to execute arbitrary code on the remote host.","Apply updates in accordance with the vendor advisory.","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21554 http://www.nessus.org/u?383fb650","Nessus was able to detect the issue by sending a specially crafted message to remote TCP port 1801." CVE = CVE-2023-21554 Risk = Critical extracted_Host = 192.168.0.1 sourcetype = csv

LionSplunk · ‎10-18-2023

Hello, i get in Splunk every 7 days a vulnerability scan log from all Hosts in our infrastructure - in the future the scan should be everyday . Now i want to filter which of the vulnerability findings are really new and which one is equal to last scan because they are not new anymore and have a reason that they are still in the filter and they should be excluded in the search output. If they scan output are the same the CVE number and the message is identical only the date is different. My output should look like that i see only event scan messages when they are only on time in the logs. When a scan log is the same (CVE Number) two times in the log it should not be showed in the output. The best thing would be when i can see in the statistics field which of the extracted_Host are new or in the logs. Right now my filter is like this: I can see in the statistics which of the extracted Host are new with the CVE number but i see in the main Event logs equal logs which are not new anymore. I tried with dedup but thats only deleting the old event logs field value and i can exclude the old event log but the newest is still here. index=nessus Risk=Critical | stats count as event_count by CVE, extracted_Host | where event_count=1 | rename extracted_Host as Host | table CVE, Host Thanks for the Help

LionSplunk · ‎10-16-2023

With this filter i see all combined risk classification per host. index=test Risk IN (Critical,High,Medium) | timechart span=30 count by extracted_Host I'm now trying to filter and visualize so I can see how often the host has the rating Critical and how often high etc. and not like now that i see only the combined value of all risk classification index=test | stats count by extracted_Host, Risk | stats values(Risk) as Risk by extracted_Host | eval has_Critical=mvcount(split(Risk, ",")) > 0 | eval has_High=mvcount(split(Risk, ",")) > 0 | eval has_Medium=mvcount(split(Risk, ",")) > 0 | stats sum(has_Critical) as Critical_Count, sum(has_High) as High_Count, sum(has_Medium) as Medium_Count by extracted_Host but i dont get an output Thanks for the help

LionSplunk · ‎10-12-2023

Hello, sorry for the missing information. i am realy new to splunk and its complicated with all parameters. I get one event per host per risk Means the host with the IP 10.10.10.10 get scanned with a vulnerability tool and after this i get a log with 20 different vulnerability events. Example maybe 2 with the risk classification Critical - 10 with the risk classification High and 8 with Medium. Every Risk is one event for this host means i get 20 different events on the same Host.

LionSplunk · ‎10-10-2023

Hello , i am new in Splunk and need help 🙂 i get every week a vulnerability scan log with 2 main fields: "extracted_Host" and "Risk" Risk values are: Critical, High and Medium (in the log is often Medium so i must only search for Risk Medium and everything else is excluded) Extracted_Host: i get many different Host IP I must filter which Host get which Risk (Hosts can have multiple Risk values) and what risk is falling away on which date and what risk is new right now i am here: Problem is i get only one host with all value fields and not how many Risk classification are really on this Host without any Time index=nessus Risk IN (Critical,High,Medium) | fields extracted_Host Risk | eval Host=coalesce(extracted_Host,Risk,) | stats values(*) as * by Host thanks for the help

Posts	10
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎10-09-2023

Online Status	Offline
Date Last Visited	‎11-14-2023 04:01 AM

Compare two timestamps

Exclude Equal Value

Filtering 2 fields with multiple values

Re: Compare two timestamps

Re: Compare two timestamps

Re: Compare two timestamps

Compare two timestamps

Re: Exclude Equal Value

Re: Exclude Equal Value

Exclude Equal Value

Re: Filtering 2 fields with multiple values

Re: Filtering 2 fields with multiple values

Filtering 2 fields with multiple values