Integration with Security Systems

# Search for denied connections from test system
grep "<somnium_ip>" /var/log/messages | grep "Deny"

# Count denied connections by destination
grep "<somnium_ip>" /var/log/messages | grep "Deny" | \
  awk '{print $NF}' | sort | uniq -c | sort -rn

(Source IP = <somnium_ip>) 
AND (First Packet Time >= <test_start>) 
AND (Action = Block OR Impact Flag = Red)

# Search logs for denied traffic
execute log filter field srcip <somnium_ip>
execute log filter field action deny
execute log display

# Search for IPS detections
execute log filter category ips
execute log filter field srcip <somnium_ip>
execute log display

SELECT 
  from_itime(itime) as time,
  srcip, dstip, dstport,
  action, attack, severity
FROM $log
WHERE srcip='<somnium_ip>'
  AND logver>=52
  AND itime>timestamp('<test_start>')
ORDER BY itime DESC

# Search for blocked traffic
clog /var/log/filter.log | grep "<somnium_ip>" | grep "block"

# Count blocks by destination
clog /var/log/filter.log | grep "<somnium_ip>" | grep "block" | \
  awk -F'DST=' '{print $2}' | awk '{print $1}' | sort | uniq -c

# View Suricata alerts during test
tail -f /var/log/suricata/suricata_<interface>/alerts.log | \
  grep "<somnium_ip>"

# Parse EVE JSON logs
jq 'select(.src_ip=="<somnium_ip>")' \
  /var/log/suricata/suricata_<interface>/eve.json

GET somnium-*/_search
{
  "query": {
    "bool": {
      "must": [
        { "term": { "result": "SUCCESSFUL" }},
        { "range": { "@timestamp": { "gte": "now-1h" }}}
      ],
      "must_not": [
        { "exists": { "field": "firewall.action" }}
      ]
    }
  },
  "aggs": {
    "by_dest": {
      "terms": { "field": "dest_ip" }
    }
  }
}

GET logs-*/_search
{
  "query": {
    "bool": {
      "should": [
        { "term": { "service": "somnium" }},
        { "term": { "event.category": "network" }}
      ],
      "filter": {
        "range": { "@timestamp": { "gte": "now-15m" }}
      }
    }
  },
  "aggs": {
    "timeline": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1m"
      },
      "aggs": {
        "by_service": {
          "terms": { "field": "service" }
        }
      }
    }
  }
}

SELECT 
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') as time,
  sourceip, destinationip, destinationport,
  "Somnium Test Result"
FROM events
WHERE "Log Source" = 'Somnium'
  AND "Somnium Test Result" = 'SUCCESSFUL'
  AND destinationip NOT IN (
    SELECT destinationip 
    FROM events 
    WHERE category = 'Firewall Deny'
      AND starttime BETWEEN <test_start> AND <test_end>
  )
LAST 24 HOURS

SELECT
  o.description,
  o.magnitude,
  e.destinationip,
  e."Somnium Test Result"
FROM events e
JOIN offenses o ON e.destinationip = o.offense_source
WHERE e."Log Source" = 'Somnium'
  AND o.status = 'OPEN'
LAST 7 DAYS

let TestResults = SomniumResults
| where TimeGenerated >= ago(1h)
| where Result == "SUCCESSFUL";
TestResults
| join kind=leftanti (
    CommonSecurityLog
    | where DeviceAction in ("deny", "drop", "block")
) on $left.DestinationIP == $right.DestinationIP
| project TimeGenerated, DestinationIP, DestinationPort, Result
| extend SecurityGap = "Traffic allowed but not blocked"

SomniumResults
| where TimeGenerated >= ago(7d)
| summarize 
    Total = count(),
    Blocked = countif(Result == "FAILED"),
    Allowed = countif(Result in ("SUCCESSFUL", "SUCCESFULL"))
  by TestType
| extend BlockRate = (Blocked * 100.0) / Total
| project TestType, Total, Blocked, Allowed, BlockRate
| order by BlockRate asc

SomniumResults
| where TimeGenerated >= ago(5m)
| where Result in ("SUCCESSFUL", "SUCCESFULL")
| join kind=leftanti (
    CommonSecurityLog
    | where DeviceAction in ("deny", "drop")
    | where TimeGenerated >= ago(5m)
) on $left.DestinationIP == $right.DestinationIP
| summarize 
    Count = count(),
    Destinations = make_set(DestinationIP)
  by bin(TimeGenerated, 5m)
| where Count > 0