Here is the search:
index=* sourcetype=Vectra-CEF vendor="Vectra Networks" cat!="HOST SCORING" |eval check_cat=case(cat="Command & Control" OR cat="Reconnaissance" OR cat="Lateral Movement" OR cat="Botnet Activity" OR cat="Exfiltration","true")| table cat | where check_cat="true"
I get events back from the search,t but the table is not built up.
The table command you used is limiting the fields to just cat
, hence your where clause is failing as the field check_cat
is not available. Try like this
index=* sourcetype=Vectra-CEF vendor="Vectra Networks" cat!="HOST SCORING" |eval check_cat=case(cat="Command & Control" OR cat="Reconnaissance" OR cat="Lateral Movement" OR cat="Botnet Activity" OR cat="Exfiltration","true") | where check_cat="true"
| table cat
OR more efficient method
index=* sourcetype=Vectra-CEF vendor="Vectra Networks" cat="Command & Control" OR cat="Reconnaissance" OR cat="Lateral Movement" OR cat="Botnet Activity" OR cat="Exfiltration" | table cat
Why use case()
here instead of if()
?
there is no else operation.
Sure there is: |eval check_cat=if(cat="Command & Control" OR cat="Reconnaissance" OR cat="Lateral Movement" OR cat="Botnet Activity" OR cat="Exfiltration","true",null())
The table command you used is limiting the fields to just cat
, hence your where clause is failing as the field check_cat
is not available. Try like this
index=* sourcetype=Vectra-CEF vendor="Vectra Networks" cat!="HOST SCORING" |eval check_cat=case(cat="Command & Control" OR cat="Reconnaissance" OR cat="Lateral Movement" OR cat="Botnet Activity" OR cat="Exfiltration","true") | where check_cat="true"
| table cat
OR more efficient method
index=* sourcetype=Vectra-CEF vendor="Vectra Networks" cat="Command & Control" OR cat="Reconnaissance" OR cat="Lateral Movement" OR cat="Botnet Activity" OR cat="Exfiltration" | table cat
Thanks both searches work. I realized that the Boolean expressions are case sensitive thats why my searches also did not work.
Yes, when used in EVAL
/WHERE
strings are case-sensitive, but if used in base search OR SEARCH
command, they are not.
Does Verbose Mode show events with the 'cat' field having the specified values?
Yes, the 'cat' field has specified values. But for some reason the eval filter does not work. The events also show cat field values excluded in the eval filter.