About nalia_v

nalia_v · ‎05-07-2021

Hello everyone. Tell me there is such an stanza - [admon://] in addon Splunk_TA_Windows for monitoring AD. I activated it and rolled into all controllers. Began to flow various events of changes to AD. But I do not see events when the user is added to some group or remove from it. Earlier was another addon - https://docs.splunk.com/Documentation/DCADAddon/1.0.1/DCADAddon/Configuretheadd-ons But since 2019, it is not supported and the entire functionality was transferred to SPLUNK Add-on for Windows. How to setup stanza Splunk_TA_Windows to monitor and change in groups in AD ?

nalia_v · ‎04-15-2021

Hello everyone, Someone may already be doing the output of grouped events with the definition of location by ip. How not to lose location data when grouping events ? In my request spl it is | search...... |stats count(tunnelid) as sessioncount, values(StartTime) as StartTime, values(tunnelid) as tunnelid, values(tunnelip) as tunnelip, values(remip) as remip, values(vendor_action) as vendor_action by user | iplocation remip Of course, when displaying one type, the location IP is displayed. How to display data on the location of each IP in grouped events ?

nalia_v · ‎03-25-2021

Hello everyone. There is a task of comparing the sessions of the user who came from the VPN and further with the same account in the RDP if user vpn = user rdp session = "matched", otherwise = "not match" Session vpn index=fortigate eventtype=ftnt_fgt_event subtype=vpn (tunneltype="ssl-tunnel" OR tunneltype="ssl-web") |transaction startswith=(logdesc="SSL VPN tunnel up") endswith=(command="SSL tunnel established") |dedup tunnelid Session rdp index=windows source = WinEventLog:Microsoft-Windows-TerminalServices* (EventCode=1149 OR EventCode=21) |mvexpand User |search User!=NOT_TRANSLATED |rex field=User "(?<user>[\w+\.\w+]*$)" |table _time,user,Source_Network_Address I haven't built the query myself yet. grateful for any thoughts on request

nalia_v · ‎02-17-2021

Hi. The topic is probably already hackneyed, but I'll ask you anyway. Classic case - the user has not logon for more than 90 days. I want to make a request through - ldapsearch, With enrichment through blood pressure AD. There is an example request https://docs.splunksecurityessentials.com/content-detail/old_passwords/ Took from the request only - there were no login for more than 90 days. | ldapsearch search="(&(objectclass=user)(!(objectClass=computer)))" attrs="sAMAccountName,pwdLastSet,lastLogonTimestamp,whenCreated,badPwdCount,logonCount" | fields - _raw host _time | convert timeformat="%Y-%m-%dT%H:%M:%S.%6QZ" mktime(lastLogonTimestamp) | convert timeformat="%Y%m%d%H%M%S.0Z" | where lastLogonTimestamp > relative_time(now(), "-90d") | convert ctime(lastLogonTimestamp) The request is processed and takes away attributes from AD, but the time of the last login-lastLogonTimestamp does not show the former not 90 days. Where is the error in the request ?

nalia_v · ‎09-19-2020

@thambisetty I will definitely like it 😃 if you can help with the request The main request erased, I'm sorry, all the same data. The request itself for the last hour was supposed to show by example the difference in events of 5 pieces. I took 5 as an example. In your version, I did not find this difference in 5 pieces.

nalia_v · ‎09-19-2020

How to find the difference of events between hosts ? If the number of events on different hosts differs by 15 ?

nalia_v · ‎07-15-2020

Hello. Again, these lookups ). The hardest thing about queries. The request itself is the identification of users who logged in not from their workstation. index=windows user!=*$ |search (EventCode=4776 OR EventCode=4624) |transaction user startswith=(EventCode="4624") endswith=(EventCode="4776") |lookup workst_user hostname as Source_Workstation OUTPUT user as login |table _time,EventCode,user,Source_Network_Address,Source_Workstation,dest_nt_host,name,status,dest,Logon_Type,Logon_Process Fields from Source_Workstation and user events are compared. Fields from the hostname and login list workst_user. The comparison itself - machines are compared among themselves, and users are among themselves. If any of the comparisons is incorrect, the output of non-matching fields in the event is incorrect. How to build the right look from these conditions ?

nalia_v · ‎07-03-2020

I am looking for ways to export data from a splanq to a database MS SQL. I looked at the community but didn’t find anything how to export data from the splunk to any DB. I found a way through DBconnect, but it doesn’t work because we have a distributed infrastructure splunk. through output. We have DBconnect deployed on a heavy forwarder. And indexes are not stored on it, they are stored on a separate server, so I can’t fulfill the request through output. On SH we are not going to put one DBConnect. Is there any other way to upload data from the splanck to the database MSSQL ?

nalia_v · ‎06-21-2020

Hello community A question was asked about how IP geodata information is provided. I came across an app https://splunkbase.splunk.com/app/3022/ Internet Service Provider (ISP). There were difficulties setting up applications. That the application worked correctly. In README, it is recommended that you edit geoipupdate conf. In the example, the password is not specified, there is no user https://github.com/splunk/seckit_sa_geolocation/blob/master/package/default/inputs.conf Where to ask for credentials for MaxMind? When starting the search, it swears at the script '/opt/splunk/etc/apps/SecKit_SA_geolocation/bin/SecKit_geo_lookup.py'.

nalia_v · ‎06-12-2020

Hello community. There were a lot of questions of cases with lookups, but something among them I did not find my answer. There is a table in Lookup - fgt_policy. The column1- is the policy number (field cfgobj in logs) and the column2- policy name. The essence of the search query is that as soon as the policy is changed on the firewall, an allergy is triggered. There is no policy name in the firewall logs themselves, there is only a field with a number, so I created a table where I transferred all the names of our policies. Also, if a new code appears in the policy field (cfgobj), add it to the table fgt_policy. But in the current result, output only known event codes (cfgobj) with the name of the policy Field in the firewall log with policy event code -cfgobj So far it looks like this. The result also includes those codes for which the description in the column2 is not yet. I will add the name of the policy to the table with my hands when new codes appear in the field cfgobj.

nalia_v · ‎03-30-2020

Adding Attributes to the Request

nalia_v · ‎03-30-2020

nalia_v · ‎03-30-2020

PavelP Thanks helped !! I didn’t look at the page for setting up this application before. The addition of this admin_all_objects capability helped. @PavelP Please tell me one request if you know. I don’t want to create another ticket separately ) The essence of the request, the first request to pull out users connected via VPN from the fortigate index, in which only the user from a certain department filters out the subquery by ldap. The output output works out as it should, BUT I still want to output the attribute CN. Full name last name middle name. Here I can’t understand how to add this attribute to the request to display. Screenshots in the attachment Tried to execute the request with I tried to fulfill the request to add the CN attribute to the search, as well as the option attrs="cn,sAMAccountName" search="(&(objectClass=user)(cn=*))" attrs="cn,sAMAccountName"

nalia_v · ‎03-30-2020

Hi PavelP I can check three times if this gives a positive result. But as I said, the request can be fulfilled only under the role of the Admin. Above, I attached a screenshot of my configuration.

nalia_v · ‎03-30-2020

nalia_v · ‎03-28-2020

Hi. I observe a problem with requests to my controller through the application Ldapsearch. Users (with the role Power) cannot fulfill the request through. An error occurs while executing the request External search command 'ldapsearch' returned error code 1. Script output = "error_message=password is mandatory in simple bind ". See attachment. I, under the role of administrator (Admin), easily perform ldap requests. Stanza is configured correctly. The connection test passes. The account under which requests are made in ldap and integration with AD in attribute worth the value UserAccountControl - DONT_EXPIRE_PASSWORD. Users with the Power role have been granted application ldapsearch rights Please, what other suggestions could there be ?

nalia_v · ‎11-06-2019

I am trying to upload data through an addon RestAPI from the portal Bitrix24. Data regarding the activity of user actions - added / deleted directory, file ... and some other actions. {"result":[{"ID":"65426","DATE":"2019-11-05T12:49:02+03:00","USER_ID":"16707","IP_ADDRESS":"XXX.XXX.XXX.XXX","USER_AGENT":"Mozilla\/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko\/20100101 Firefox\/70.0","TYPE":"dir","ACTION":"create","OBJECT_ID":"406544","ENTITY_NAME":"\u0420\u0435\u043c\u043e\u043d\u0442 \u0438 \u0432\u0441\u0451 \u0447\u0442\u043e \u0441 \u043d\u0438\u043c \u0441\u0432\u044f\u0437\u0430\u043d\u043e","ENTITY_SIZE":"0","ENTITY_PATH":"\u0422\u0430\u0442\u044c\u044f\u043d\u0430 \u041c\u043e\u0442\u044b\u043b\u044c\/","ENTITY_VERSION":"","ENTITY_NAME_NEW":"","ENTITY_VERSION_NEW":"","ENTITY_PATH_NEW":""}, {"ID":"65425","DATE":"2019-11-05T12:48:37+03:00","USER_ID":"17071","IP_ADDRESS":"XXX.XXX.XXX.XXX","USER_AGENT":"Mozilla\/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident\/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","TYPE":"file","ACTION":"upload","OBJECT_ID":"406543","ENTITY_NAME":"\u042f \u043f\u043e\u0434\u0430\u0440\u044e \u0442\u0435\u0431\u0435 \u041a\u0440\u044b\u043b\u044c\u044f. \u041a\u043d\u0438\u0433\u0430 File_name.pdf","ENTITY_SIZE":"2604457","ENTITY_PATH":"\u0425\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u0434\u043b\u044f \u0412\u0435\u0431-\u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0430\/35793\/","ENTITY_VERSION":"1","ENTITY_NAME_NEW":"","ENTITY_VERSION_NEW":"","ENTITY_PATH_NEW":""}, {"ID":"65424","DATE":"2019-11-05T12:47:46+03:00","USER_ID":"16707","IP_ADDRESS":"XXX.XXX.XXX.XXX","USER_AGENT":"Mozilla\/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko\/20100101 Firefox\/70.0","TYPE":"file","ACTION":"view","OBJECT_ID":"80519","ENTITY_NAME":"File_name88.pdf","ENTITY_SIZE":"469506","ENTITY_PATH":"\u0410\u043b\u0435\u043a\u0441\u0435\u0439 \u0414\u0430\u043d\u0438\u043b\u0438\u043d\/\u0417\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b\/","ENTITY_VERSION":"1","ENTITY_NAME_NEW":"","ENTITY_VERSION_NEW":"","ENTITY_PATH_NEW":""} The POST request itself is a normal URL with parameters in the line userID and Token by which the connection is made. I can’t drop it here, because it contains confidential data. Our corporate developers wrote specially api (on the Bitrix24 portal) to upload such data. Fine ! the slank takes them, but here it takes away ALL the data at once. And there is a lot of data for different dates. Also, our developers of the Bitrix24 portal have provided fields by which you can filter the request. But in which fields to specify them in the addon RestAPI settings. Query Parameters for Filtering Data (They are the same fields in the event.) ID date_from date_to type action limit offset I think the most basic fields by which you can filter with melon incrementation are: ID date_from date_to But where to specify them in the add api addon is unclear. And if you rely on a time stamp, then how to increase the day

nalia_v · ‎11-06-2019

The moderator is still checking my answer ))

nalia_v · ‎11-06-2019

Hi arjunpkishore5. higher answer.

nalia_v · ‎11-06-2019

I apologize if somewhere there is already this topic on the portal. If there is, please click on the link. Question There is a rest api request by POST method There is a rest api request using the post method, which accesses the URL and picks up the log in the format JSON. JSON log itself is VERY large and voluminous. When collecting, the forwarder and its turn begins to flow memory and CPU. The problem is that the log in the response is very large, but the log has unique ID and time fields. [{"ID":"65426","DATE":"2019-11-05T12:49:02+03:00" How can I configure / build a post request with filtering by timestamp or ID field ? That is, if by timestamp, the request would take logs only for the current day and increment the data. Or compared the ID field. How to specify these settings in the filter through the addon RestAPI ?

Posts	20
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎11-06-2019

Online Status	Offline
Date Last Visited	‎05-07-2021 05:15 PM

AD Monitoring objects

iplocation when outputting in command stats

compare fields by vpn session user and rdp session

the user has not logon AD for more than 90 days

The difference in the number of events on differen...

Comparing two fields from events with fields from ...

How to export data from a Splunk to a database

How to work with the Seckit_sa_geolocation

Adding a field to the table Lookup if there is no ...

ldapsearch error_message=password is mandatory in ...

AD Monitoring objects

iplocation when outputting in command stats

compare fields by vpn session user and rdp session

the user has not logon AD for more than 90 days

Re: The difference in the number of events on diff...

The difference in the number of events on differen...

Comparing two fields from events with fields from ...

How to export data from a Splunk to a database

How to work with the Seckit_sa_geolocation

Adding a field to the table Lookup if there is no ...

Re: ldapsearch error_message=password is mandatory...

Re: ldapsearch error_message=password is mandatory...

Re: ldapsearch error_message=password is mandatory...

Re: ldapsearch error_message=password is mandatory...

Re: ldapsearch error_message=password is mandatory...

ldapsearch error_message=password is mandatory in ...

Re: Filtering the request POST in Rest API

Re: Filtering the request POST in Rest API

Re: Filtering the request POST in Rest API

Filtering the request POST in Rest API