Search for specific patterns in Splunk cloud platform

0
votes

I am new to splunk and am trying to perform incident analysis of a compromised domain controller security event logs. I am using the free trial version of splunk cloud platform and ingested the csv data and let splunk automatically create the indexes. The attack is a brute force attack and it seems that some malicious user tried to find the members of a remote desktop user group in the AD.

Splunk Search events results I am attaching a screenshot of my current splunk search result and the further filter that I want to use [ highlighted in black ]. As you will see in the current search result, it is listing many such events, but I am only interested in certain events, where under the Subject section, the account names have values other than a given set of names (say ID4$, Admin, Harvester etc.). How can that be achieved?

2
splunk
Can't you just add a NOT CASE(ID4$) NOT CASE(Admin) NOT CASE(Harvester) to the search? If those terms can appear other places and you need to have the Account Name part there then what about adding | search NOT "Account Name: ID4$" NOT "Account Name: Admin" NOT "Account Name: Harvester" to the search? If you have more complicatd stuff you can use a where statement with like or match to allow wilcards and regex - you could add | where !match(_raw,"Account Name: *ID4\$") AND !match(_raw,"Account Name: *Admin") AND !match(_raw,"Account Name: *Harvester") - Jerry Jeremiah

2 Answers

1
votes

First, I'd strongly recommend you take the free courses available from Splunk: https://www.splunk.com/en_us/training.html?sort=Newest&filters=filterGroup1FreeCourses

Second, you need to look for field=value pairs in your data

Like this:

index=ndx sourcetype=srctp fieldA=valA fieldB=valB* fieldC=valC
| stats values(host) as host values(valB) by fieldA fieldC
0
votes

To add on to @warren's answer, you need to extract fields before they can be searched. Then you can filter based on those fields.

index=foo source=bar 
| rex field=EXTRA_FIELD_6 "Account Name:\s*(?<Account_Name>\w+)
| search NOT Account_Name IN ("ID4$", "Admin", "Harvester")