How can I search for a URL that a user or users may have clicked on from a SPAM or phishing email?

[doogan12]

Often times users click the link or open a attachment in a SPAM or phishing email. I would like to be able to enter a URL in a search that will find if any recipients clicked the link in order to isolate their machines.

One part will list the URL to search on and another will list the host that connected to it.

Thank you!

[ChrisG]

Not a full answer, but without more information in your question, it will be hard for the community to help you. Here is a blog post that you might want to read: https://www.splunk.com/blog/2015/07/01/phishing-what-does-it-look-like-in-machine-data/

And the risk analysis in Splunk Enterprise Security might also be interesting for you, see https://www.splunk.com/blog/2014/08/12/risk-analysis-with-enterprise-security-3-1/.

[richgalloway]

Are you indexing the logs from your web proxy server? Or do you have another source for the URLs? Once you have the data in Splunk we can help you search for it.

[doogan12]

Will probably have the search check all indexes either with index=* or by listing them with "OR" - maybe even make a dropdown box where there is a choice as to which index to check.

[richgalloway]

index=* is inefficient for a regular query. Use it to find the data you need then put the exact index name in the final SPL.
My original point was it's hard to help without knowing more about your environment. Yes, Splunk can do what you want, but only if it has the data it needs. Once you've confirmed you have a source of URL clicks then we can help you craft a search for those who fell for phishing emails.

[doogan12]

Sorry for the delay, was able to narrow a few things down.
My search looks like this and is part of a dashboard:

index=primary_index sourcetype=firewall ref="$ref$" | stats count by src, dst, ref, method, webhost, uri | sort ip, -url

I'll still have to do something with listing hostnames, but will tweak as I can.

Thank you for your previous responses - shift work interferes with my replies.