Data Analytics Using Splunk 9.x by Dr. Nadine Shillingford

Author:Dr. Nadine Shillingford
Language: eng
Format: epub
Publisher: Packt
Published: 2023-02-15T00:00:00+00:00

There is a lot of traffic between these two hosts but not every traffic event is a login attempt. Therefore, we include form_data=* to display only the events where an attempt was made to log in to the imreallynotbatman.com site. Figure 6.32 shows the output of this query:

Figure 6.32 – Table chart shows brute-force attack on 192.168.250.70

Do we have a command that we can use to extract the password from the form_data field? Yes, we do! We use the rex command to extract the portion of alphanumeric characters that follow the passwd= string in the form_data field. Then, we use the table command to display the data: index=botsv1 earliest=0 sourcetype=stream:http dest_ip="192.168.250.70" src_ip="23.22.63.114" form_data=*

| rex field=form_data "passwd=(?<passwd>\w+)\&?"

| table _time, form_data, passwd

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.