Hi Splunkers,
We have realized our "First Time Seen Running Windows Service " Correlation search seen below has been giving alot of false positives. This correlation search came with Splunk ES Content Update.
index=wineventlog eventtype=wineventlog_system signature_id=7036
| rex field=Message "The (?[\w\s-]*) service entered the (?\w*) state"
| where action="running"
| inputlookup append=t previously_seen_running_windows_services
| multireport
[| stats earliest(eval(coalesce(_time, firstTime))) as firstTime, latest(eval(coalesce(_time, lastTime))) as lastTime by serviceName
| outputlookup previously_seen_running_windows_services
| where fact=fiction]
[| eventstats earliest(eval(coalesce(_time, firstTime))) as firstTime, latest(eval(coalesce(_time, lastTime))) as lastTime by serviceName
| where firstTime >= relative_time(now(), "-60m@m") AND isnotnull(_time)
| stats values(dest) as dest by _time, serviceName]
| table _time, serviceName, dest
After inspecting every hostname with this alert we have come to conclusion that we have actually seen this service before on the hostname. The alarm actually looks only for the last sixty minutes of the hostname. Is this rule intented that way or is there a method to fix and get cleaner positive results ?
We know that any services ran before, and still is running even though the alarm keeps mentioning that the service was seen running for the first time.
Thanks, Regards .
↧