Suspicious Log Entries

Detects suspicious log entries in Linux log files

Rule Content

- title: Suspicious Log Entries
  id: f64b6e9a-5d9d-48a5-8289-e1dd2b3876e1
  description: Detects suspicious log entries in Linux log files
  author: Florian Roth
  logsource:
    product: linux
    service: null
    category: null
  detection:
    keywords:
    - entered promiscuous mode
    - Deactivating service
    - Oversized packet received from
    - imuxsock begins to drop messages
    condition: keywords
  falsepositives:
  - Unknown
  level: medium

Querying Elasticsearch

Import Libraries



In [ ]:

    
from elasticsearch import Elasticsearch
from elasticsearch_dsl import Search
import pandas as pd

Initialize Elasticsearch client



In [ ]:

    
es = Elasticsearch(['http://helk-elasticsearch:9200'])
searchContext = Search(using=es, index='logs-*', doc_type='doc')

Run Elasticsearch Query



In [ ]:

    
s = searchContext.query('query_string', query='\*.keyword:(*entered\ promiscuous\ mode* OR *Deactivating\ service* OR *Oversized\ packet\ received\ from* OR *imuxsock\ begins\ to\ drop\ messages*)')
response = s.execute()
if response.success():
    df = pd.DataFrame((d.to_dict() for d in s.scan()))

Show Results



In [ ]:

    
df.head()