Splunk Exercise - Fixit

Scenario

In this challenge room, you will act as John, who has recently cleared his third screening interview for the SOC-L2 position at MSSP Cybertees Ltd, and a final challenge is ready to test your knowledge, where you will be required to apply the knowledge to FIX the problems in Splunk.
You are presented with a Splunk Instance and the network logs being ingested from an unknown device.

Note: Splunk is installed in the /opt/splunk directory, and you will be working in the App called Fixit.

Challenge: FIXIT

This challenge is divided into three levels:

Level 1: Fix Event Boundaries

Fix the Event Boundaries in Splunk. As the image below shows, Splunk cannot determine the Event boundaries, as the events are coming from an unknown device.

Level 2: Extract Custom Fields

Once the event boundaries are defined, it is time to extract the custom fields to make the events searchable.

- Username
- Country
- Source_IP
- Department
- Domain

Sample Logs: To create regex patterns, sample Network logs are shown below:

[Network-log]: User named Johny Bil from Development department accessed the resource Cybertees.THM/about.html from the source IP 192.168.0.1 and country 
Japan at: Thu Sep 28 00:13:46 2023
[Network-log]: User named Johny Bil from Marketing department accessed the resource Cybertees.THM/about.html from the source IP 192.168.2.2 and country 
Japan at: Thu Sep 28 00:13:46 2023
[Network-log]: User named Johny Bil from HR department accessed the resource Cybertees.THM/about.html from the source IP 10.0.0.3 and country 
Japan at: Thu Sep 28 00:13:46 2023

Level 3: Perform Analysis on the FIXED Events

• Once the custom fields are parsed, we can use those fields to analyze the Event logs. Examine the events and answer the questions.

Question and Answers section:

• What is the full path of the FIXIT app directory?

/opt/splunk/etc/apps/fixit

• What Stanza will we use to define Event Boundary in this multi-line Event case?

  BREAK_ONLY_BEFORE
  

  • Look at the original event structure from Level 1 section above
• In the inputs.conf, what is the full path of the network-logs script?

/opt/splunk/etc/apps/fixit/bin

• What regex pattern will help us define the Event’s start?

[Network-log]: User named Daniel Martin from Marketing department accessed the resource Cybertees.THM/signup.html from the source IP 192.168.1.103 and country 
Germany at: Thu Apr 18 21:24:43 2024

Answer:

\[Network-log\]

After fixing it:

• What is the captured domain?

  cybertees.thm
  

• How many countries are captured in the logs?

Setup in the default directory:

<transforms.conf>
[network-logs_custom_fields]
REGEX = country\s+(\w+)
FORMAT = Country::$1
WRITE_META = true

<props.conf>
[network_logs]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = \[Network-log\]
TRANSFORM-network_logs = network-logs_custom_fields

<fields.conf>
[Country]
INDEXED = true

Regex:

Output:

Answer:

12 -> not sure how TBC

• How many departments are captured in the logs? Possible regex to use:

  from\s+(\w+)\s+department
  

Updated configuration files:

<transforms.conf>
[network-logs_custom_fields]
REGEX = country\s+(\w+)
FORMAT = Country::$1
WRITE_META = true

REGEX = from\s+(\w+)\s+department
FORMAT = Department::$1
WRITE_META = true


<props.conf>
[network_logs]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = \[Network-log\]
TRANSFORM-network_logs = network-logs_custom_fields

<fields.conf>
[Country]
INDEXED = true

[Department]
INDEXED = true

Answer:

Update again:

/opt/splunk/bin/splunk restart

Answer:

6

• How many usernames are captured in the logs? Possible regex to use:

  User named\s+(\w+\s+\w+)\s+from
  

Updated configuration files:

<transforms.conf>
[network-logs_custom_fields]
REGEX = country\s+(\w+)
FORMAT = Country::$1
WRITE_META = true

REGEX = from\s+(\w+)\s+department
FORMAT = Department::$1
WRITE_META = true

REGEX = User named\s+(\w+\s+\w+)\s+from
FORMAT = Username::$1
WRITE_META = true


<props.conf>
[network_logs]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = \[Network-log\]
TRANSFORM-network_logs = network-logs_custom_fields

<fields.conf>
[Country]
INDEXED = true

[Department]
INDEXED = true

[Username]
INDEXED = true

Update again:

/opt/splunk/bin/splunk restart

Answer:

28

• How many source IPs are captured in the logs? Possible regex to use:

  source IP (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) and
  

Updated configuration files:

<transforms.conf>
[network-logs_custom_fields]
REGEX = country\s+(\w+)
FORMAT = Country::$1
WRITE_META = true

REGEX = from\s+(\w+)\s+department
FORMAT = Department::$1
WRITE_META = true

REGEX = User named\s+(\w+\s+\w+)\s+from
FORMAT = Username::$1
WRITE_META = true

REGEX = source IP (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) and
FORMAT = SrcIP::$1
WRITE_META = true

<props.conf>
[network_logs]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = \[Network-log\]
TRANSFORM-network_logs = network-logs_custom_fields

<fields.conf>
[Country]
INDEXED = true

[Department]
INDEXED = true

[Username]
INDEXED = true

[SourceIP]
INDEXED = true

Update again:

/opt/splunk/bin/splunk restart

- Since the event is increasing, the answer is changing. Make sure to enter it after refreshing the page.

• Which configuration files were used to fix our problem? [Alphabetic order: File1, file2, file3]

  fields.conf, transforms.conf, props.conf
  

• What are the TOP two countries the user Robert tried to access the domain from? [Answer in comma-separated and in Alphabetic Order][Format: Country1, Country2]

71

• Which user accessed the secret-document.pdf on the website?

Answer:

Sarah Hall