Splunk BOSS of the SOC ver3について(Short notice)

https://github.com/splunk/botsv3
出てました。
以後のSPLは、全時間検索でお願いします。

https://findingbad.blogspot.com/2020/05/hunting-for-beacons.html?spref=tw

https://opstune.com/2020/06/05/spl-nuggets-know-your-admins-from-eventlogs/

ここらも、頑張ろう

#sourcetype
```bash:index=botsv3
sourcetype,count
"access_combined",3907
alternatives,4
"amazon-ssm-agent",905
"amazon-ssm-agent-too_small",1408
"apache_error",63
"aws:cloudtrail",6571
"aws:cloudwatch",4936
"aws:cloudwatch:guardduty",1
"aws:cloudwatchlogs",115145
"aws:cloudwatchlogs:vpcflow",97448
"aws:config:rule",255
"aws:description",522
"aws:elb:accesslogs",2051
"aws:rds:audit",35192
"aws:rds:error",5
"aws:s3:accesslogs",1274
bandwidth,297
"bash_history",100
bootstrap,10
"cisco:asa",80192
"cloud-init",1344
"cloud-init-output",23
"code42:api",88
"code42:computer",51
"code42:org",17
"code42:security",30
"code42:user",192
"config_file",9
cpu,596
"cron-too_small",44
df,209
dmesg,1164
dpkg,23
"error-too_small",1
errors,437
"errors-too_small",635
"ess_content_importer",2
hardware,3
"history-2",2
interfaces,1038
iostat,297
lastlog,209
"linux_audit",112
"linux_secure",350
"localhost-5",30
lsof,103
"maillog-too_small",6
"ms:aad:audit",31
"ms:aad:signin",220
"ms:o365:management",1073
"ms:o365:reporting:messagetrace",711
netstat,1037
"o365:management:activity",977
openports,4246
"osquery:info",83961
"osquery:results",219997
"osquery:warning",110
"out-3",17
package,19
"perfmonmk:process",864
protocol,1038
ps,2073
"script:getendpointinfo",3
"script:installedapps",9
"script:listeningports",867
"stream:arp",14432
"stream:dhcp",382
"stream:dns",218456
"stream:http",24191
"stream:icmp",2506
"stream:igmp",852
"stream:ip",227872
"stream:mysql",42541
"stream:smb",153
"stream:smtp",879
"stream:tcp",84031
"stream:udp",157960
"symantec:ep:agent:file",504
"symantec:ep:agt_system:file",94
"symantec:ep:behavior:file",2192
"symantec:ep:packet:file",11550
"symantec:ep:risk:file",1
"symantec:ep:scm_system:file",46
"symantec:ep:security:file",46
"symantec:ep:traffic:file",5811
syslog,283976
time,3
top,1038
"unix:listeningports",490
"unix:service",1137
"unix:sshdconfig",19
"unix:update",12
"unix:uptime",3
"unix:useraccounts",571
"unix:version",3
userswithloginprivs,19
vmstat,296
who,417
"wineventlog:application",719
"wineventlog:microsoft-windows-applocker/exe and dll",187
"wineventlog:microsoft-windows-applocker/packaged app-execution",152
"wineventlog:microsoft-windows-powershell/operational",92
"wineventlog:security",46469
"wineventlog:system",482
winhostmon,129679
"xmlwineventlog:microsoft-windows-sysmon/operational",9212
"yum-too_small",63
```
aws多いな、linux command結果やSymantecのウィルス対策ソフトのログもあって、[botsv2](https://github.com/splunk/botsv2)とはかなり違うかも

#hosts

| firstTime | host | lastTime | recentTime | totalCount | type |
|:--|:--|:--|:--|--:|:--|
| 2018-08-20 13:00:03 | MKRAEUS-L | 2018-08-21 00:17:28 | 2018-08-30 05:53:01 | 59425 | hosts |
| 2018-08-20 13:22:31 | BSTOLL-L | 2018-08-21 00:17:59 | 2018-08-29 23:41:57 | 101918 | hosts |
| 2018-08-20 18:00:00 | splunk.froth.ly | 2018-08-21 00:17:53 | 2018-08-21 00:27:56 | 17549 | hosts |
| 2018-08-20 18:00:13 | serverless | 2018-08-21 00:26:46 | 2018-08-21 00:27:51 | 247791 | hosts |
| 2018-08-20 18:01:10 | matar | 2018-08-21 00:19:35 | 2018-08-21 00:20:58 | 84337 | hosts |
| 2018-08-20 18:02:14 | gacrux.i-06fea586f3d3c8ce8 | 2018-08-21 00:27:09 | 2018-08-21 00:27:22 | 43523 | hosts |
| 2018-08-20 18:02:34 | SEPM | 2018-08-21 00:17:25 | 2018-08-21 00:23:07 | 20383 | hosts |
| 2018-08-20 18:02:45 | mars.i-08e52f8b5a034012d | 2018-08-21 00:18:00 | 2018-08-21 00:18:20 | 158512 | hosts |
| 2018-08-20 18:03:38 | BTUN-L | 2018-08-21 00:17:56 | 2018-08-21 00:24:27 | 76371 | hosts |
| 2018-08-20 18:03:43 | FYODOR-L | 2018-08-21 00:18:00 | 2018-08-21 00:18:00 | 65138 | hosts |
| 2018-08-20 18:03:46 | JWORTOS-L | 2018-08-21 00:18:00 | 2018-08-21 00:18:17 | 55550 | hosts |
| 2018-08-20 18:03:51 | gacrux.i-09cbc261e84259b54 | 2018-08-21 00:17:08 | 2018-08-21 00:17:09 | 42000 | hosts |
| 2018-08-20 18:03:51 | ip-172-16-0-109.ec2.internal | 2018-08-21 00:18:00 | 2018-08-21 00:18:21 | 83673 | hosts |
| 2018-08-20 18:03:52 | BGIST-L | 2018-08-21 00:18:00 | 2018-08-21 00:18:02 | 18314 | hosts |
| 2018-08-20 18:04:08 | hoth | 2018-08-21 00:17:58 | 2018-08-21 00:18:32 | 382718 | hosts |
| 2018-08-20 18:04:13 | FROTHLY-FW1 | 2018-08-21 00:18:00 | 2018-08-21 00:18:00 | 80192 | hosts |
| 2018-08-20 18:04:14 | splunkhwf.froth.ly | 2018-08-21 00:17:59 | 2018-08-21 00:17:59 | 78478 | hosts |
| 2018-08-20 18:04:19 | console.us.code42.com:443 | 2018-08-21 00:16:48 | 2018-08-21 00:22:47 | 378 | hosts |
| 2018-08-20 18:04:28 | ip-172-16-0-127 | 2018-08-20 23:47:53 | 2018-08-20 23:47:53 | 413 | hosts |
| 2018-08-20 18:05:27 | ip-172-31-12-76 | 2018-08-21 00:17:28 | 2018-08-21 00:17:29 | 222 | hosts |
| 2018-08-20 18:05:59 | ip-172-16-0-13 | 2018-08-20 23:47:52 | 2018-08-20 23:47:53 | 418 | hosts |
|:--|:--|:--|:--|--:|:--|
| 2018-08-20 18:09:32 | ABUNGST-L | 2018-08-20 23:42:30 | 2018-08-20 23:42:31 | 52335 | hosts |
| 2018-08-20 18:11:11 | PCERF-L | 2018-08-21 00:18:00 | 2018-08-21 00:22:32 | 65184 | hosts |
| 2018-08-20 18:45:00 | gacrux.i-0920036c8ca91e501 | 2018-08-21 00:18:00 | 2018-08-21 00:18:18 | 175345 | hosts |
| 2018-08-20 18:45:44 | ip-172-16-0-178 | 2018-08-21 00:16:12 | 2018-08-21 00:16:13 | 173 | hosts |
| 2018-08-20 18:50:10 | ip-172-31-36-235 | 2018-08-20 23:47:15 | 2018-08-21 00:14:34 | 1073 | hosts |
| 2018-08-20 19:33:04 | ntesla | 2018-08-20 19:33:05 | 2018-08-20 19:33:56 | 2 | hosts |
| 2018-08-20 22:33:16 | gacrux.i-0cc93bade2b3cba63 | 2018-08-20 23:19:51 | 2018-08-20 23:19:51 | 32261 | hosts |
| 2018-08-20 22:33:18 | ip-172-16-0-145 | 2018-08-20 23:19:49 | 2018-08-20 23:19:49 | 415 | hosts |
| 2019-09-20 03:10:50 | OD-FM-NA-i-0ad2d665d4bdace22.amazonaws.com | 2019-09-20 03:10:50 | 2019-09-20 03:10:50 | 1 | hosts |

```java:metadata_hosts.spl
| metadata type=hosts index=botsv3
| sort 0 firstTime
| foreach *Time [ eval <<FIELD>> = strftime('<<FIELD>>',"%F %T")]
```
30ホスト。ざっとみてみると`2018-08-20`と`2018-08-21`に集まっていて、８月いっぱいのログがあったり、`2019-09-20`のログがポツンとある。

```java:ホスト毎のソースタイプ一覧
| tstats count where index=botsv3 by sourcetype host
| xyseries host sourcetype count
| rename host as _host
| foreach * [ eval sourcetypes = mvappend(sourcetypes,"<<FIELD>>")]
| rename _host as host
| table host sourcetypes
| transpose 0 header_field=host
```
流石に表を貼り付けられなかったので、クエリーだけ。
awsのログが各ホストに紐づけられている。
AWSか〜勉強しないと

ここまでとします。