Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
fikretbaydilli1 Trusted Contributor.
Trusted Contributor.
209 views

Correlation Problem for User Tracking - Need Help

Hi,

I want to create correlation rule for user tracking, and I need help with to do this correlation. I created a rule however it didn’t work. I summarized the case below with screenshots.

  • On this case there are 3 types of logs; first and second logs are IIS logs (IISLog01 and IISLog02), third log is a security device log (FWLog)
  • What I want to do is
    if
    (IISLog01’s “source translated address” and IISLog02’s “Attacker Address” is same)
    and
    (IISLog02’s “Source  User Name” and FWLog’s “Source User Name” is same)
    in 1 minute I want to see these logs in an active list under one correlated log.
  • I added screenshots about the that I wrote (I changed ip address and names)
  • This query returns with empty result.
  • I aggregated the only fields that I used in query because there are lots of field in events. I tried aggregate everything that I need but the result didn’t change.

arcsightcase01.PNG arcsightcase02.PNG arcsightcase03.PNG

Labels (3)
0 Likes
2 Replies
Acclaimed Contributor.. Shaun Acclaimed Contributor..
Acclaimed Contributor..

Re: Correlation Problem for User Tracking - Need Help

Are the timestamps on the logs all correct?

0 Likes
Highlighted
fikretbaydilli1 Trusted Contributor.
Trusted Contributor.

Re: Correlation Problem for User Tracking - Need Help

Yes, they are correct.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.