I need more karma points to post images. 😞 ... View more

product=Windows EventCode=645 OR EventCode=4741 | timechart span=1w count| eval Severe=if(count>25,count,0) | eval High=if(count<=25 AND count>20,count, 0)| eval Moderate = if(count<=20 AND count>15,count,0) | eval Low = if(count<=15 AND count>7,count, 0) | eval Very Low = if(count<=7 AND count>0,count, 0)| rename _time as Date |convert timeformat="%Y-%m-%d" ctime(Date) {"Severe":0xFF0000,"High":0xff8000,"Moderate":0xFFFF00,"Low":0x00FF00,"Very Low":0x0000ff} ... View more

I did post my answer. I will make another question. Thanks! ... View more

Right after I posted the question I remembered dedup! Always happens.... Appreciate your assistance! ... View more

End goal is instead of having 17 alerts on the same host for the same event (in this case, unable to log) I just want 1 alert for all 17 events based on :insert host:. So for instance. If host x,y and z fire this alert I would want three alerts because the host is different and not because the alert simply fired again. There is no threshold more like an aggregation of the events over the course of an hour so that only 1 alert fires. Sorry for not being more specific. ... View more

My goodness I knew it would be easy.... Sigh ... View more

Done and Done ... View more

Perfect! Thanks! ... View more

At this point I would settle for using an eval command to change my time 8/23/16 6:50:17.000 PM to BST Is that even possible? ... View more

Thanks for your response but you obviously copied and pasted whats in the props.conf documentation....I've already looked at that.... ... View more

Below are two events from both appliances: Regarding share the expected output I thought I answered this? (sincerely....). When you say share expected output I'm thinking "I just want the attacker addresses making it through the clients IPS and hitting their firewall." Apologies for the miscommunication....what are you looking for if this isn't it? CEF:0|Imperva Inc.|SecureSphere|11.5.0|Custom|Custom Violation|Medium| eventId=9308631149 proto=TCP catdt=Network-based IDS/IPS art=1470932478330 cat=Alert deviceSeverity=Medium act=Block rt=1470932472000 shost=researchscan271.eecs.umich.edu src=141.212.122.16 sourceZoneURI=/All Zones/ArcSight System/Public Address Space Zones/RIPE NCC/141.0.0.0-141.255.255.255 (RIPE NCC) spt=1254 dst=172.20.50.11 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 dpt=80 duser=n/a cs1=Custom_Blocked_UserAgents cs2=(redacted) cs3=(redacted) cs4=(redacted) cs5=Custom_Blocked_UserAgents cs6=747586722184 cs1Label=Policy cs2Label=ServerGroup cs3Label=ServiceName cs4Label=ApplicationName cs5Label=Description cs6Label=EventID ahost=WIN-MFGNMJGIUIK agt=172.16.227.50 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 av=7.0.1.6963.0 atz=America/New_York aid=3A2MJJEUBABCAA3I6E0GXmg\=\= at=syslog dvc=172.16.227.74 deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 dtz=America/New_York _cefVer=0.1 ad.cs7= ad.cs7Label=SessionID CEF:0|TippingPoint|SMS||7120|TCP: Segment Overlap With Different Data, e.g., Fragroute|Medium| eventId=9310952616 externalId=35354 app=ip/IP categorySignificance=/Informational/Warning categoryBehavior=/Communicate categoryTechnique=/Traffic Anomaly/Transport Layer categoryDeviceGroup=/IDS/Network categoryOutcome=/Failure categoryObject=/Network art=1470934026394 cat=Application/Protocol Anomaly - Protocol Anomaly deviceSeverity=Low act=Block rt=1470933958006 src=216.82.250.247 sourceZoneURI=/All Zones/ArcSight System/Public Address Space Zones/ARIN/216.0.0.0-216.255.255.255 (ARIN) spt=21360 dst=8.36.160.48 destinationZoneURI=/All Zones/ArcSight System/Public Address Space Zones/Level 3 Communications Inc. 2 dpt=25 requestClientApplication=Other Service or Server Application cs2=00000002-0002-0002-0002-000000007120 cs3=00000001-0001-0001-0001-000000007120 cs4=ANY ANY cs5=172.16.7.240 flexString1=1 cn1=0 cn2=100739839 cs2Label=policyUUID cs3Label=signatureUUID cs4Label=ZoneNames cs5Label=Device Name cn1Label=VLAN ID cn2Label=Alarm Id ahost=WIN-MFGNMJGIUIK agt=172.16.227.50 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 av=7.0.1.6963.0 atz=America/New_York aid=3A2MJJEUBABCAA3I6E0GXmg\=\= at=syslog dvchost=(redacted) dtz=America/New_York deviceInboundInterface=2 _cefVer=0.1 ... View more

Sorry first time doing something like this.... If I posted a redacted version of an event from index=(company acronym) cef_vendor="Imperva Inc." and one from cef_vendor=TippingPoint and removing any mention of the company that would be fine? In terms of the index consider it the "main" index. Everything is on one index. The sourcetype is just "CEF". We're forwarding data from an ArcSight logger into the splunk environment....not ideal circumstances here...just working with what I have. ... View more

I'm curious though wouldn't it show up under both if it's going through one to get to the other? Fur instance under TippingPoint it would be "action=Allow" and under Imperva Inc "action=Block". Thank you ... View more

Hello Thank you for your responses. The information is coming in view cef format, so the fields are somewhat different. What I imagine it would look like is something like this... (we're using Imperva and TippingPoint) index=(company acronym) cef_vendor="Imperva Inc." AND cef_vendor=TippingPoint | stats values by src | sort - count The end result is I just want to see if attacking IP's are getting through to the IPS and hitting the firewall. Running the script above, I get no results. Removing one of the vendors, results pop up, so I'm assuming that none of the events can be correlated together? Sundareshr thanks for the example. Thank you ... View more