Hi!
I want to use a tstats search to monitor for network scanning attempts from a particular subnet:
| tstats `summariesonly` dc(All_Traffic.dest) as dest_count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest="10.*" OR All_Traffic.dest="172.*" OR All_Traffic.dest="192.168.*") AND All_Traffic.src=10.128.0.0/16 by All_Traffic.src
| sort - dest_count
| where dest_count > 70
My index2 contains IP addresses and users (src_ip, user and event contains text string "LOCAL") that I would like to match with the All_Traffic.src IP addresses, so I would get the last user name that used the particular All_Traffic.src in the results. I have tried both join and map with no success:
| tstats `summariesonly` dc(All_Traffic.dest) as dest_count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest="10.*" OR All_Traffic.dest="172.*" OR All_Traffic.dest="192.168.*") AND All_Traffic.src=10.128.0.0/16 by All_Traffic.src
| sort - dest_count
| where dest_count > 70
| rename All_Traffic.src AS src_ip
| join type=left src_ip
[search index=index2 "LOCAL"
| head 1
| fields src_ip user ]
| table All_Traffic.src dest_count user
join returns All_Traffic.src and dest_count without users.
| tstats `summariesonly` dc(All_Traffic.dest) as dest_count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.dest="10.*" OR All_Traffic.dest="172.*" OR All_Traffic.dest="192.168.*") AND All_Traffic.src=10.128.0.0/16 by All_Traffic.src
| sort - dest_count
| where dest_count > 70
| rename All_Traffic.src AS srcip
| map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 | fields user"
| table All_Traffic.src dest_count user
map returns users, but no All_Traffic.src and dest_count
What is the correct way to get the results I need?
Thank you.
| map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 | fields user"
→
| map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 |eval dest_count =$dest_count$ | fields src_ip dest_count user"
| map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 | fields user"
→
| map search="search index=index2 "LOCAL" src_ip=$srcip$ | head 1 |eval dest_count =$dest_count$ | fields src_ip dest_count user"
Can you post this as an answer, so I can mark it as the correct one? I don't have the option to do this on a comment. Thanks 🙂
This works, thank you very much!
| table All_Traffic.src dest_count user
→
| table src_ip dest_count user
you renamed the field.