need query with threatIntel and Apache logs
I have created a dashboard for status code from apache logs.
Now I want to compare destination IP hitting Apache server should be searched in Intel threat database. If the IP match Intel threat database then we should see it on dashboard. Is there way we can compare destination IPs hitting Apache with Intel threat database?
Any suggestion or inputs ?
-
Official comment
Hey Dungar,
I recommend installing our Threat Intel Quick Analysis App and pointing it at your apache data so you can use all of the pre-built dashboards and searches without having to manually create them.
An example of a search from this app applied to your apache data is:
_sourceCategory=*apache*
| parse regex "(?<ip_address>\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| where ip_address != "0.0.0.0" and ip_address != "127.0.0.1"
| count as ip_count by ip_address
| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=ip_address
| json field=raw "labels[*].name" as label_name
| replace(label_name, "\\/","->") as label_name
| replace(label_name, "\""," ") as label_name
| where type="ip_address" and !isNull(malicious_confidence)
| if (isEmpty(actor), "Unassigned", actor) as Actor
|sum (ip_count) as threat_countComment actions -
Hi Graham ,
Thanks for your suggestion.
find below query and let me know if it is possible to apply threat intel rule to check destination IP.
If destination IP found in threatintel database then we should see that destination IP along with status code.
_sourceCategory=Apache/Access POST
| parse "GET * HTTP/1.1\" * * \"*\"" as url,status_code,size,referrer
| timeslice 1m
| count by status_code, _timeslice
| sort by _timeslice, status_code asc
| transpose row _timeslice column status_code -
Hey Dungar,
Can you provide a query that has the dest_ip parsed out?
This might be what you're looking for, which I used our Threat Intel App queries to create:
_sourceCategory=Apache/Access
| parse regex "(?<ip_address>\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| parse "GET * HTTP/1.1\" * * \"*\"" as url,status_code,size,referrer
| where ip_address != "0.0.0.0" and ip_address != "127.0.0.1"
| timeslice 5m
| count as ip_count by ip_address, _source, status_code
| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=ip_address
| json field=raw "labels[*].name" as label_name
| replace(label_name, "\\/","->") as label_name
| replace(label_name, "\""," ") as label_name
| where type="ip_address" and !isNull(malicious_confidence) //and malicious_confidence in ("Low","Medium","High")
| if (isEmpty(actor), "Unassigned", actor) as Actor
|sum (ip_count) as threat_count by ip_address, malicious_confidence, status_code, Actor, _source, label_name
| sort by threat_count
Please sign in to leave a comment.
Comments
6 comments