get_web_posts_by_src.json

{
  "creation_date": "2018-12-06",
  "data_metadata": {
    "data_models": [
      "Web"
    ],
    "data_source": [
      "Web"
    ],
    "providing_technologies": [
      "Splunk Stream",
      "Bro",
      "Bluecoat",
      "Palo Alto Firewall"
    ]
  },
  "description": "This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. ",
  "entities": [
    "src"
  ],
  "how_to_implement": "To successfully implement this search, you must be ingesting your web-traffic logs and populating the web data model.",
  "id": "f5c39fac-205c-4e07-9004-8fd61ea3431a",
  "investigate": {
    "splunk": {
      "fields_required": [
        "src"
      ],
      "schedule": {
        "cron_schedule": "",
        "earliest_time": "3600",
        "latest_time": "3600"
      },
      "search": "| tstats `summariesonly` values(Web.url) as url from datamodel=Web by Web.src,Web.http_user_agent,Web.http_method | `drop_dm_object_name(\"Web\")`| where like(src, \"{src}\") and like(http_method, \"POST\")"
    }
  },
  "maintainers": [
    {
      "company": "Splunk",
      "email": "jhernandez@splunk.com",
      "name": "Jose Hernandez"
    }
  ],
  "modification_date": "2018-12-06",
  "name": "Investigate Web POSTs From src",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "jhernandez@splunk.com",
      "name": "Jose Hernandez"
    }
  ],
  "spec_version": 2,
  "type": "splunk",
  "version": "1.0"
}