The bucket command will slice the Splunk timeline of events into discrete buckets of time determined by the user. The search syntax below will bucket a Splunk timeline into discrete five minute chunks, regardless of the length of the timeline:
bucket _time span=5min
The second method is provided by the Splunk search command "stats." The stats command does many things, but one of the things it does best is sorting data by other data. The following search syntax will show all DNS queries of every host in the Splunk timeline, regardless of the length of the timeline:
stats values(dns_query) by source_host
Showing posts with label dfir. Show all posts
Showing posts with label dfir. Show all posts
Basics of Windows Incident Response
https://jordanpotti.com/2017/01/20/basics-of-windows-incident-response/
New online site
A new site I found via some cohorts on twitter. Not sure on the validity of data just yet, but could become a useful addition to the toolbox.
https://suspect-networks.io/
Subscribe to:
Posts (Atom)