admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refactor search query for prohibited network traffic

Browse Source 
### **Describe the bug**
When interesting_ports_lookup is used, only the port is checked, not the protocol.
Plus, only the first result is returned.
This lookup include several entries for the same port (like 514 rsh/syslog) and the wrong entry can get returned.
This create false match. The wrong enrichment is given (including a wrong transport method) and a notable is generated when it shouldn't.
It can also be greatly optimized by moving the filter logic to the where of the tstats.

### **Expected behavior**
If a 514 udp is detected by the firewall, it should match syslog and not create a notable (or risk) telling me we detected a rsh 514 tcp.

### **Additional context**
Here is a solution (we get the transport from the log instead of adding it from the lookup, add transport to the match and move the filter logique up).
This commit is contained in:
LaLaGuy
2026-01-15 19:44:41 +01:00
committed by GitHub
parent 26b24aaa6e
commit e2443809bb
1 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/network/prohibited_network_traffic_allowed.yml
+12 -7
View File
@@ -15,13 +15,18 @@ description: The following analytic detects instances where network traffic, ide
compromising the organization's security posture.
data_source:
- Cisco Secure Firewall Threat Defense Connection Event
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Network_Traffic where All_Traffic.action IN ("allowed", "allow") by
All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action
All_Traffic.dvc All_Traffic.src_port All_Traffic.vendor_product All_Traffic.rule | lookup update=true
interesting_ports_lookup dest_port as All_Traffic.dest_port OUTPUT app is_prohibited
note transport | search is_prohibited=true | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `prohibited_network_traffic_allowed_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
from datamodel=Network_Traffic
where All_Traffic.action IN ("allowed", "allow")
[| inputlookup interesting_ports_lookup where is_prohibited="true" 
| table dest_port transport | dedup dest_port transport 
| rename dest_port as All_Traffic.dest_port | rename transport as All_Traffic.transport]
by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action All_Traffic.dvc All_Traffic.src_port All_Traffic.vendor_product All_Traffic.rule
| lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `drop_dm_object_name("All_Traffic")`
| `prohibited_network_traffic_allowed_filter`'
how_to_implement: In order to properly run this search, Splunk needs to ingest data
from firewalls or other network control devices that mediate the traffic allowed
into an environment. This is necessary so that the search can identify an 'action'