Visualization of FirewallD-logs in SPLUNK

From Datateknik
Revision as of 10:12, 18 May 2017 by NIT16 (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Make sure you have a secure password!!

caption

Contents

FirewallD logs in SPLUNK

Check that you have a text-file (log) with ip attack data (use less ...)

Install SPLUNK

  • install splunk do NOT install splunk if you alreade have installed it
wget -O splunk-6.5.3-36937ad027d4-linux-2.6-x86_64.rpm 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=6.5.3&product=splunk&filename=splunk-6.5.3-36937ad027d4-linux-2.6-x86_64.rpm&wget=true'
echo "--------------------------"
yum localinstall splunk-6.5.3-36937ad027d4-linux-2.6-x86_64.rpm
rpm -ql splunk | grep splunk$
echo "--------------------------"
# firewall-cmd --add-rich-rule='rule family="ipv4" port port="8000" protocol="tcp" accept'

Import data into splunk

Not so difficult

Search data and Draw the Map

  • Click on the large green button "Search & reporting"
  • View all your data in "excel" format
 source="/var/log/attacker.log"
  • Select SRC data by typing SRC ( or | SRC )
 source="/var/log/attacker.log" SRC
  • Pipe SRC-data into stats-module: source="/var/log/attacker.log" SRC | stats count by SRC
 0.0.0.0                        123
 1.0.232.123                     23
 1.1.12.4                        12
  • SRC | stats count by SRC | iplocation SRC
SRC	        count	        City		Country		Region	lat		lon
0.0.0.0	176	 	 	 	 	 
1.0.243.134	1				Thailand		13.75000	100.46670
123.10.169.5	1		Uddevalla	Sweden			13.75000	100.46670
1.10.170.79	1				Thailand		13.75000	100.46670
1.11.242.151	1		Seoul		Rep. of Korea	Seoul	37.51110	126.97430
  • Plot data with geostats: SRC | stats count by SRC | iplocation SRC | geostats latfield=lat longfield=lon count
    TIP: you might need to click the tab /Visualzation\ and select Cluster Map
NICE MAP

latitude     Longitude    Count
-49.12312    -68.123123      12
 12.45234     31.1231         7
-12.12312     12.1233       300
  • Save the map to your dashboard by clicking "Save As "

Search data and plot Attack Ports

  • DPT | stats count by DPT | sort - count | head 16
  • Save the plot to your dashboard by clicking "Save As "

List the 16 Worst towns in Sweden

SRC | iplocation SRC | search Country="Sweden" | stats count by City | sort - count | head 16

  • Click "Save as "
Personal tools
Namespaces

Variants
Actions
Navigation
Tools