Search for Event "A" and NOT Event "B" within a given period of time

Question

We are sending anti-virus logs to Splunk. I am trying to create a search that would first, find logs indicating event "A" which is a virus was detected, then look ahead 60 seconds for event "B" which is a virus was cleaned. I want to show only logs that find event "A" but NOT event "B". This basically are the events that we would need to manually correct. I also want to ensure that the computer and virus names the same in both log events. Below are some samples of the logs.

Any assistance would be appreciated. Thanks in advance.

01/14/2012 08:15:14 PM LogName=Application SourceName=AV Server EventCode=600 EventType=3 Type=Warning ComputerName=av-server1 User=SYSTEM Sid=S-1-5-18 SidType=1 TaskCategory=System OpCode=None RecordNumber=17037 Keywords=Classic Message=Virus/Malware: TROJ_GEN.R49C7AE Computer: workstation01 File: C:System Volume Information_restore{93998DF6-4B0C-40FB-9311-0B790FF41A3C}RP292A0028002.dll Date/Time: 1/14/2012 20:15:14 Result: Virus detected

01/14/2012 08:15:45 PM LogName=Application SourceName=AV Server EventCode=500 EventType=3 Type=Warning ComputerName=av-server1 User=SYSTEM Sid=S-1-5-18 SidType=1 TaskCategory=System OpCode=None RecordNumber=17038 Keywords=Classic Message=Virus/Malware: TROJ_GEN.R49C7AE Computer: workstation01 File: C:System Volume Information_restore{93998DF6-4B0C-40FB-9311-0B790FF41A3C}RP292A0028002.dll Date/Time: 1/14/2012 20:15:43 Result: Cleaned

Accepted Answer

I was able to achieve what I needed, by using this thread's answer as a reference. The sanitized search I created is below. Thank you all for your assistance.

sourcetype="antivirus" [ search sourcetype="antivirus" EventCode=600 | eval earliest=_time | eval latest=_time+60 | fields earliest,latest | format "(" "(" "" ")" "OR" ")" ] | eval status = if(EventCode="500",1,0) | stats sum(status) as statusCount values(virus) by Computer,file_name | where statusCount = 0

This search finds an event indicating malware was found but not cleaned. It then uses that timestamp as a reference and look ahead 60 seconds. If it does not find an event indicating that the malware was cleaned, it will trigger. The search runs -6m@m to -1m@m every 5 minutes.

Answer 2

0

You should look into transactions, which would be one way of making this work. Applicable docs are at http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Abouttransactions

link

answered 15 Jan '12, 18:49

dwaddle ♦
15.2k●2●9●23
accept rate: 33%

1

Definitely transactions. Using the 'startswith' option may help, as may the linecount field. Something like: SourceName="AV Server" EventCode=500 OR EventCode=600 | transaction Computer,Message startswith=(EventCode=500) endswith=(EventCode=600) | search linecount>1

(15 Jan '12, 19:53) southeringtonp ♦

If the transaction starts with eventcode=600 and "normally" ends with eventcode=500, how do I create a search that finds all events that start with eventcode=600 and fails to end with eventcode=500?

(15 Jan '12, 20:14) jodros

1

Usually there are two ways. Either look at the value of linecount (I said search linecount>1 before, but yours may be more than 1 since you're dealing with multi-line events. Or int this case a better way is probably to pipe to search again and put something like | search NOT EventCode=500 at the end instead of the search on linecount. (The transaction should leave you with a multivalue field for EventCode). There may also be a way to do it with streamstats and some clever search/where clauses -- would have to give that approach some more thought when I'm more awake.

(15 Jan '12, 21:04) southeringtonp ♦

2

eventcount may be better suited for checking how many events a transaction includes. :-)

(16 Jan '12, 00:30) Ayn

Answer 3

Another option is to use a subsearch. Unfortunately there is no specific eventID that link the two events together (infected/cleaned), so this example will be less than perfect. Let's assume that the File field is unique enough for these puropses.

The main search is looking for "infected" events. The subsearch returns the File field for all "cleaned" events. This is then added to the main search with a NOT. The result should be all "infected" events, minus those that have a corresponding "cleaned" event (based on the File field).

sourcetype=XXX EventCode=600 NOT [search sourcetype=XXX EventCode=500 | fields + File]

Replace the sourcetype, and add further qualifying fields (to both the subsearch and the main search) to get the correct results.

http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork#Use_subsearch_to_correlate_data

UPDATE:

The "timerange substituted" message is displayed because you alter the earliest/latest parameters within the search string, i.e. it differs from the dropdown-value (e.g. "last 15 min", "last 4 hrs" etc). The results you're getting may not be correct.

I don't think you should try to alter the time parameter (i.e. don't care if there is 60 seconds or so between the 500 and 600 events). Try instead to fine a common ID value for the two events, and use subsearch (as shown above) to find "infected" events that do not have a corresponding "cleaned" event.

Otherwise you should probably try transaction on a combination of fields like File, Virus/Malware, Computer etc. I don't know if a transaction is 'built' if there is only one event, i.e. it might not be a good to use startswith and endswith as described in another answer, since what you really want are the 'faulty' transactions, where there is no ending 'cleaned' event. As Ayn stated, there is the eventcount parameter which could do the trick here.

Somebody more knowledgeable with transactions can maybe help out.

Hope this helps,

Kristian

Search for Event "A" and NOT Event "B" within a given period of time

Follow this question

Splunk Resources

Related questions