Introduction
This article will discuss understanding the aggregated data in the search section, how to filter the data and reach desired information easily, and how to perform analysis.
Understanding Aggregated Data and Analyzing with Search Techniques
Event Mapping Columns
The relevant columns are not actually found in the data from sources, but are enriched and addressed on Logsign, allowing the end user to search and filter data in a simpler and more understandable way.
EventMap.Type: Type of the data. For example, an attempt by a user to log into a system.
EventMap.SubType: Subtype of the data. For example, whether a user's attempt to log into a system was successful.
EventMap.Context: Information about which category the data belongs to. For example, Network, Security, User activity.
EventMap.ID: An ID has been defined and standardized on Logsign for each action taken in the incoming data. This information is included in this column.
EventMap.Info: Generally, information contained in the data is included in this column. For example, "Web Access Allow", "Network Connection Deny", "User Login Deny".
Source Columns
These are columns containing information about the source in the incoming data. Below are a few examples of these columns:
Source.IP: Source IP address.
Source.Port: Source port number.
Source.UserName: Source username.
Destination Columns
These are columns containing information about the destination in the incoming data. Below are a few examples of these columns:
Destination.UserName: Destination username.
Destination.GroupName: Destination group name.
Destination.Country: Name of the country where the destination IP address is located.
The left side of the Search screen contains the Filters panel (smart filtering section). The panel first lists a fixed set of frequently used columns, such as Source.IP, Source.UserName, Destination.IP, Destination.Port, EventMap.Context, EventMap.Type and EventMap.SubType, followed by the other columns found in the events currently listed on the page.
To access the desired column easily, type the column name, or part of it, into the Find Column box at the top of the panel. Only the columns whose names contain the typed text are listed. The match is not case-sensitive, but the text is compared with the column name as it is written, including the dot. For example, typing source.ip lists the columns whose names contain Source.IP, while "source ip" (with a space) does not match them.
Afterwards, to view the values within a certain column, click on that column. A search box opens below it. When you click into this box, up to 50 of the most frequent values in the selected time range are listed in descending order, together with their event counts. If desired, you can type a term into the box to narrow down the values, and selecting a value adds it to the search as a filter.
In the example given in the screenshot below, an example search is performed for the activities carried out using the target port 443 on the security device with the IP address 10.10.100.100.
If it is also desired to check which user names carried out these activities, this can be easily done in the smart filtering section by checking the relevant column.
In the examples given in the screenshots below, it is shown separately which resources 10.10.100.100 IP address and "ismail" user moved on. Analysis related to which resources specific IP addresses or user names made movements on can be easily performed in this way.