About poiromaniax

poiromaniax · ‎04-07-2022

@woodcock sorry to resurrect this topic - but can you give some suggestions on how to run near real-time alerts without alerting on the same events if the window overlaps?

poiromaniax · ‎12-13-2021

Thanks for the answer! I will give it a go

poiromaniax · ‎12-07-2021

Hey all, Firstly - the title doesnt actually encapsulate what Im trying to do, Ill try break it down simply: I have AWS FlowLogs and AWS Route53 DNS resolver logs (in same index, different sourcetypes) I want to search the FlowLogs but have it do a DNS lookup against the Resolver logs and then output it as a table. Right now I have a query like: (index=aws sourcetype=flowlogs) | lookup dnslookup clientip as dest_ip OUTPUT clienthost as dest_DNS | lookup dnslookup clientip as src_ip OUTPUT clienthost as src_DNS | table _time dest_ip dest_DNS dest_port src_ip src_DNS src_port vpcflow_action However, I would like to have the dest_ip and src_ip lookup against route53 resolver log, and then put THAT result in the table as dest_DNS and src_DNS Is this even possible?

poiromaniax · ‎08-01-2021

I opened a ticket with Splunk Support about this. Here is the reply: I have research further on this and found that Splunk removed OpenJDK in 8.0.5. It's only used by DFS. If you're not using DFS, you can delete it in both places, SPLUNK_HOME/bin/jars and SPLUNK_HOME/etc/apps/splunk_archiver/java-bin/jars Please find the steps below: 1. Browse to the following directories and remove the .jar files: - $SPLUNK_HOME/bin/jars - $SPLUNK_HOME/etc/apps/splunk_archiver/java-bin/jars/ ## Only proceed when the above is complete on all splunk instances ## 2. On all SH instances (SH,CM, Deployer, Deployment Server, License Master), delete all existing knowledge bundles from $SPLUNK_HOME/var/run ## Only proceed once step 3 is complete ## 3. On the indexers, delete all existing knowledge bundles from $SPLUNK_HOME/var/run/searchpeers

poiromaniax · ‎06-17-2021

@isbjorn wondering the same thing - did you manage to solve this?

poiromaniax · ‎04-21-2021

Hi all, I am using $results_link$ in an alert. Something changed in the last few months and when clicking on the link, it brings up a loadjob which only shows stats in a table and no longer displays the events themselves. Does anyone have any insight as to what might have changed and if there is a way to revert this?

poiromaniax · ‎04-21-2021

Hi all, I am using slack_alerts addon to send Slack messages. It allows for use of tokens in the message body as referenced here https://docs.splunk.com/Documentation/Splunk/8.1.3/Alert/EmailNotificationTokens (E.G AWS CloudTrail events) I am trying to figure out a way that I can either: a) Have various fields renamed to a single field (such as a security group ID, or a bucket name be rewritten to field called "resource") so that I can reference this field in my token ($result.resource) b) have a dynamic token that looks at various fields Currently I just have a line in my alert that looks like: *Resource:* `$result.requestParameters.policyName$ $result.requestParameters.policyArn$ $result.requestParameters.groupId$ $result.responseElements.groupId$ $result.requestParameters.groupDescription$ $result.requestParameters.bucketName$` but this is messy and the results show up with spaces before and after the value I was wondering if strcat is the right search expression to use for this, the search runs in realtime so it shouldnt make a jumble fo 2 or 3 resources in a single line? Hoping someone will have some useful insight

poiromaniax · ‎01-20-2021

@scelikok thanks for the response. I expanded all fields and I cannot see any duplicates. I also sent the alert via email in case it was specific to Slack, but same result. Search is: index=aws tag=authentication NOT (action=success user=*$) | search (action="failure") src_user!=unknown | search "requestParameters.roleArn"!="arn:aws:iam:xxxxxxxxxxxxx" | search "requestParameters.roleSessionName"!=xxxxxxxxxxxxx

poiromaniax · ‎01-18-2021

Hi all, I have a strange issue that I cant seem to find any info on and I'm hoping someone can help me. I have a few alerts that are sent to Slack using the slack_alerts addon from Splunkbase. Recently, the results of these alerts are duplicated within the alert itself. (I am not receiving multiple of the same alert individually) This is the alert config: AWS Authentication Failed *Time:* $result.eventTime$ *Event:* $result.eventName$ *Account:* $result.recipientAccountId$ *User:* $result.userName$ *Source IP:* $result.sourceIPAddress$ *EventID:* $result.eventID$ And the result: AWS Authentication Failed Time: 2021-01-18T10:40:16Z 2021-01-18T10:40:16Z Event: AssumeRoleWithSAML AssumeRoleWithSAML Account: 22xxxxxxxxxx 22xxxxxxxxxx User: xxxxxxxxx Source IP: 54.89.xxxxxxx 54.89.xxxxxxxx EventID: 862b7079-e38b-4b1e-xxxxxxxxx 862b7079-e38b-4b1e-xxxxxxxx I have tried recreating the alerts, removing and readding the Slack addon but same behaviour Hoping someone can help!

poiromaniax · ‎03-25-2020

Hi all, We have our ossec logs from servers being sent to a forwarder and then the forwarder to indexer. On the forwarder, sourcetype is configured as ossec_alerts In search results, the source host shows as the forwarder and not the actual server it comes from. The actual server name shows up right next to the date/time but not as a parsed field. EG: 2020/03/20 17:23:00 srv-01 SOURCE=forwarder Any ideas?

Posts	11
Solutions	0
Karma Given	4
Karma Received	2
Member Since	‎03-11-2020

Online Status	Offline
Date Last Visited	‎07-02-2023 03:31 AM

Multiple queries question

results_link opening loadjob

Alert tokens and dynamic fields

Alerts - results.fieldname duplicated?

Forwarder not parsing Ossec logs correctly

Re: Why are realtime searches disliked in the Splu...

Re: Multiple queries question