sguil.tk query builder getting past 'Click in the text box....'

[controlling chaos]

OK, I know this is probably incredibly stupid and obvious, and google was not my friend on this. Not to mention probably an inappropriate question for this forum, but....

Yesterday there were a large number of HSRP events, and snort flagged them. So I'm trying to build an event query in sguil.tk to dig a bit deeper.

I'm in query builder. Select query type 'Events' is selected.
The text box says:

WHERE event.timestamp > '2014-08-22' AND <insert query here>

So I click (or highlight, I've tried both) in the <insert query here> space.

Then below that I select TABLES -> event -> Signature (var string) 255

If I move back up to the 'edit where clause1' box, and click on the 'LIKE' button, I get a complicated looking error box.

If I just click 'Submit' (which feels wrong, since there's nothing to submit yet) I get a 'Click in the text box you want to insert data into first'.

Tried lots of different combos. Googled all morning. No joy.

I'm sure it's something plainly intuitive and obvious to the casual observer, but I'm at a loss as to what to do next.

Help?

thx.

[Doug Burks]

Hi control-chaos,

How are you going into Query Builder? When I click Query --> Query
Builder, I do not get the "WHERE event.timestamp > '2014-08-22' AND
<insert query here>" part.

Can you provide screenshots?

You may also want to consider searching in ELSA if you have that enabled.

> --
> You received this message because you are subscribed to the Google Groups "security-onion" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
> To post to this group, send email to securit...@googlegroups.com.
> Visit this group at http://groups.google.com/group/security-onion.
> For more options, visit https://groups.google.com/d/optout.



--
Doug Burks
Need Security Onion Training or Commercial Support?
http://securityonionsolutions.com

[controlling chaos]

Be happy to. Hope it attaches properly 8)

Thanks!

[controlling chaos]

I just reread what you typed. I am not going into query builder from query-> query builder. I was getting there via query->query event table. It didn't cross my mind to go directly to query-> query builder (yeah, I know...).

Let me play with that a bit and I'll get back to you.

[controlling chaos]

OK, tried direct query -> query builder and wound up at the same place. See attached.

[Doug Burks]

Yes, I'm able to duplicate this. Looks like a bug. Here are a few options:

- select TABLES -> event -> Signature (var string) 255 and then
*middle-click* in the "Where Clause" box. This will copy/paste the
entire highlighted text, so you'll need to remove some of the extra
text.

- simply type "signature" manually

- use ELSA

On Sun, Aug 31, 2014 at 3:09 PM, controlling chaos
<contro...@inbox.com> wrote:
> OK, tried direct query -> query builder and wound up at the same place. See attached.
>