Splunk Search

How can I show results for a field that is disabled and not re-enabled in a certain amount of time?

JRougeau
Engager

How can I show results for a field that is disabled and not re-enabled in a certain amount of time?

I want to be alerted when AV protection on an endpoint is disabled for a period of time without being re-enabled. Ex: IF signature="Protection Disabled" AND (more than 5 minutes passes without Signature="Protection Enabled") THEN generate alert.

Tags (3)
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Make a list of all the other fields that are used to identify the target item in question. Let's assume for this example that it is host and service.

This gets you all the items that have been disabled for more than 5 minutes.

index=foo host=* service=* signature=* | stats latest(_time) as _time, latest(signature) as signature by host, service | where _time < relative_time(now(),"-5min") AND signature="Protection Disabled"

Now, if you want to find all the items where the signature stayed as "Protection Disabled" for more than 5 minutes, then you'll probably have to define a transaction starting with the signature="Protection Disabled" and ending with signature= anything else, and use the duration of the transaction to flag the results.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Make a list of all the other fields that are used to identify the target item in question. Let's assume for this example that it is host and service.

This gets you all the items that have been disabled for more than 5 minutes.

index=foo host=* service=* signature=* | stats latest(_time) as _time, latest(signature) as signature by host, service | where _time < relative_time(now(),"-5min") AND signature="Protection Disabled"

Now, if you want to find all the items where the signature stayed as "Protection Disabled" for more than 5 minutes, then you'll probably have to define a transaction starting with the signature="Protection Disabled" and ending with signature= anything else, and use the duration of the transaction to flag the results.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...