Splunk Enterprise Security

Is there any way to to compare two different log sources to get the output

cdev24
New Member

Hi Experts,

I need your help to create query to show output when a system is infected with any malware\virus (Source anti virus)and same is generating traffic (strong textsource firewall)

Challenge I am facing is that in Antivirus log infected host is dest_ip and in firewall logs source is src_ip.

Other thing is I am unable to find any common field between two logs (Anti virus and Firewall)

Sample logs for Anti virus :

"2016-12-29 12:43:26" Type="SecurityIncident", RowID="AACDE705-F0A9-46B0-BE27-C0ECF81554A7", Name="MalwareInfection", Description="NotImplemented", Timestamp=1451418206600, SchemaVersion="1.0", ObserverHost="hostname", ObserverUser=0, ObserverProductName="SystemCenterEndpointProtection", ObserverProductversion="4.8.0204.0", ObserverProtectionType="AM", ObserverProtectionVersion=0, ObserverProtectionSignatureVersion=0, ObserverDetection="Realtime", ObserverDetectionTime=1451418206600, ActorHost=0, ActorUser=0, ActorProcess=0, ActorResource=0, ActionType="MalwareInfection", TargetHost="Thost", TargetUser="Tuser", TargetProcess="C:\Windows\explorer.exe", TargetResource="file:_E:\O F F I C E\PDFCreatorWebSetup.exe", ClassificationID=2147697638, ClassificationType="Trojan:Win32/Dorv.B!rfn", ClassificationSeverity="Severe", ClassificationCategory="Trojan", RemediationType="Quarantine", RemediationResult="True", RemediationErrorCode=0, RemediationPendingAction="NoActionRequired", IsActiveMalware="False"

Sample logs of Firewall

Dec 29 15:18:38 FHost 1,2015/12/29 15:18:38,007701001134,TRAFFIC,drop,1,2015/12/29 15:18:32,80.82.79.104,10.X.X.X,0.0.0.0,0.0.0.0,LOG-OUTSIDE,,,not-applicable,vs1,OUTSIDE,INSIDE,ethernet1/1,,Forward to Panorama,2015/12/29 15:18:32,0,1,41237,8080,0,0,0x0,tcp,deny,60,60,0,1,2015/12/29 15:16:06,0,any,0,7857899777,0x8000000000000000,china,UK,0,1,0,policy-deny
0 Karma

jkat54
SplunkTrust
SplunkTrust

With join:
index=antivirus | eval src_ip=dest_ip | join src_ip [ search index=firewall ]

With map:
index=antivirus dest_ip=* | map [ search index=firewall src_ip=$dest_ip$]

0 Karma

sundareshr
Legend

If I am reading this right, you are looking to find events if the host field in the av logs and source field in the firewall logs are the same. Is that right? Have you tried something like this

index=* (sourcetype=antivirus OR sourcetype=firewall) | eval ip=if(sourcetype=antivirus, host, source) | ...

This will give you a common field between the two to analyze.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...