How to compare field from one stream with other?

Graylog Central (peer support)
1

Hi team,

Here is my query about comparing one field from one stream with other. I am collecting logs from packetbeat port 53 from Windows based DNS server and its being stored in one stream also I am collecting logs from DNS sinkhole which has forwarder set from DNS.

So the flow would be on -

  • Users desktop we have Windows based DNS set;
  • Which has packetbeat running and capturing packets on port 53 [say network-stream]
  • Then we have forwarder set for DNS Sinkhole server
  • Which are again getting ingested in Graylog in other stream [say dns-stream]
    Now I wanted to have one more stream configured for below scenario and would really appreciate if someone can help me on this?

User ABC [ip 10.10.10.10] --> xyz.com --> Windows DNS —> DNS Sinkhole
As soon as DNS Sinkhole DNS query is flagged’ wanted the same query to be checked from Windows stream and if found should highlight IP address.

Thanks and Regards,
Blason R

2

check for the slookup plugin - that might help you with this.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.