topic Search Logs using Domain Name in Src in General Topics

Search Logs using Domain Name in Src

zaoar — Wed, 13 Dec 2023 09:51:24 GMT

Hi mates,

I was wondering if there is any way or workaround to do a search in logs (gathering all my logs on SMS)

using an *.domain_name* as source.

I ve seen another thread with similar question and answer is : "i cant "

But since this was a 2020 topic and we are now almost 4 years after , I was wondering if anything changed.

A guess would be that Source in logs is stored with IP only and on SmartConsole when I query them there is a live reverse lookup happening, and that's why i see the names listed in Source, but this information is not stored so i cant use this parameter to search???

Or maybe not... 🙂

Anyone can help me or take me out of my miserly confirming that there is nothing i can do?

Regards,

Aris

Re: Search Logs using Domain Name in Src

G_W_Albrecht — Wed, 13 Dec 2023 13:37:40 GMT

You can only search for src: if the search term resolves to an IP.

Re: Search Logs using Domain Name in Src

zaoar — Wed, 13 Dec 2023 14:32:45 GMT

thanks for reply.

Ok this makes sense

Although a SmartConsole feature to be able to filter src: *domainname* on a list of logs that has been already resolved would be great.

I mean, fore example,

I've filtered my logs for a specific timeframe and dst machine in my DMZ network and I am able to see a list of logs with Sources IPs and resolved names. Which is great. All I need now is to filter on top of this result using part of domain name as source.

I mean i realized and tested and works, that if i export the search result to a csv, the domain names are also exported. So I can then do what i need from Excell and find for example if any source *domainname* accessed my DST server.

Regards,

Aris