Help with search logic for complex query

Graylog Central (peer support)
1

Hi,

I am trying to wrap my head around trying to do a more complex search in Graylog and need a bit of a sounding board on if it is possible at all.

I am ingesting logs from a totally awesome product called Symantec Messaging Gateway (sarcasm intended). Extracting the fields and pumping the IPs through the Graylog threat engine. It is in turn reporting any threats.

At this point, you are probably wondering why. Because we have a lot of missed identifications and “spam storms” coming through that i am trying to catch before our users report them.

It sends about 7-8 messages for every email that goes through it. I have written extractors for all the fields and have those working really well so that all the data is indexed and searchable.

What i am left with is 2 messages that look like this:

  1. SERVERNAME bmserver: 1592204913|c0a86442|LOGICAL_IP|1.1.1.1
  2. SERVER NAME ecelerity[32024]: 1592204914|c0a86442|DELIVER|192.168.100.57:25|email@address.com

With everything between the pipes extracted to individual fields and the appropriate threat detected fields etc etc added to the first one.

So what i want to know is messages that feature the DELIVER flag but also have a threatdetected from an earlier syslog message, which only exists on the LOGICAL_IP flag, essentially, joining on the message ID which is c0a86442

Problem is that i don’t think this is possible in standard query, but was wondering if there was a way to do this i wasn’t aware of or haven’t thought of.

TIA

2

he @network_master

what Graylog version are you using?

3

Oops, probably should have included

Community Edition of Graylog 3.2.6+e255fcc on (Oracle Corporation 1.8.0_252 on Linux 3.10.0-1127.10.1.el7.x86_64)

Plan to upgrade to 3.3 as soon as i can check all the dependencies

4

he @network_master

when you have the data in seperate fields you can run aggregation&filter event queries and run additional on top of the already created messages. So you have nested events condition that look for specific information.

Together with the correlation engine you could detect what you are looking for easily without it might be also possible…

5

Thanks Jan,

I had a bit of a play with aggregation in the searches earlier, but i couldn’t quite get it to work.

I might have to have a bit more of a play with it tomorrow, but good to know I was on the right track.

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.