Activeboards Fundamentals - Exercise 3.5 - Heatmap widget (I)

  • 1 February 2023
  • 3 replies
  • 20 views
Activeboards Fundamentals - Exercise 3.5 - Heatmap widget (I)
alexdevo
Rank
Userlevel 4
Badge

This time, Arcadia wants to query their Suricata IDS table to look for relevant threats that are not trojans. Then, they want to geographically represent these threats in a map. Let’s go!

  • Open the ids.suricata.fast data table.
  • We already know that we do not want to focus on trojans, so we could use a negative weakhas over the signature field.
  • This might not get rid of all entries containing trojan information on other fields different than signature. Can you devise additional ways of getting rid of trojan-related events?
  • Let’s continue by enriching with new fields for latitude and longitude using the src_ip field as the argument.
  • Now group every 30 minute by these new fields.
  • Remember to filter after enriching too.
  • Then group every 30 minutes by the new geolocation fields.
  • Aggregate the data with a count operation. 

 

A query representing the previous steps would look like this one:

from ids.suricata.fast

    where not weakhas(signature,"trojan")

    select mm2latitude(src_ip) as latitude,  

    mm2longitude(src_ip) as longitude

    where isnotnull(latitude), 

    isnotnull(longitude)

    group every 30m by latitude, longitude

    select count() as count

 

  • Now set the query as the data source of a heatmap widget. Save the changes.
  • Open the properties panel of the widget and enter the visual tab.
  • Set the zoom level to 4.
Alex | Devo Training Team

3 replies

M
Userlevel 2

Hi Alex,

I see that, after running “from ids.suricata.fast where not(weakhas(signature,"trojan"))”,

there are still some values related to trojans in the field “classification”; 

 

Wouldn’t it be more efficient to filter out “trojan” from the field “raw” instead of “signature” from the beginning?

Thanks!

alexdevo
Rank
Userlevel 4
Badge

Hello Minion! It’s great to see your awesome level at Devo querying. You found the hidden gem in the exercise. 

Wouldn’t it be more efficient to filter out “trojan” from the field “raw” instead of “signature” from the beginning?

 

This is indeed the most efficient way of filtering any pieces of string out: using toktains over the raw special field. This will parse the token index with all the fields instead just one field. In this case, as the classification field uses “Trojan” with a capital T, and the toktains operation is case sensitive, we better use weak toktains:

where not weaktoktains(raw,"trojan")

 

Thanks for your interest with these exercises!

Alex | Devo Training Team
M
Userlevel 2

Thanks for the “weak” tip, very useful!

Reply


Terms & ConditionsCookie settings