export ip

[m]

Hi

how can I create a file containing a list of IPs that are subject of a specific event? I would like the ip corresponding to the failed logins coming from the firewall agent to be inserted into a file.

thanks

[Julio Gasco]

Hi Matteo,

Thanks for using our community!

What you can do to achieve this is create a search from the discover section of Kibana and export the CSV, where you will then be able to see all the IPs.

To do so follow these steps

1- On Kibana go to Discover

2- On the Discover page, press Add filter and create the filter: Field = rule.id Operator=is and Value=Rule you want to filter in this example 23504

3- After getting the result at the top right of the screen you can modify the time you want to cover, then press Save to save the query.

4- Once Query is saved on the top right click Reporting and Generate CSV

This will download automatically the CSV Report when you open it on Excel you will be able to see the IP column and filter by it as seen below, You can then remove all unnecessary columns or copy and use this information.

Let me know if this covers your question

Regards!!

[Matteo]

Hi Julio

thanks for your reply

I would like to automate this task, as a kind of wazuh autoresponder (see for example that of pfsense)

[Julio Gasco]

Hi Matteo,

You can automate the report creation following the next steps:

When you have the query search as explained on my previous message, on Discovery click Reporting -> Create Report Definition

On The report setting set a name, and in report source, check Saved search and below select the saved query you created.

Below you will see the report trigger option, On trigger type select Schedule and on Request time select Recurring, below you will be able to set the frequency and time of creation

Once created the report will run and be available on the reporting Menu

Let me know if this was what you required,

Regards!

[Matteo]

Hi Julio

thanks for your reply.

where is the exported file saved? I would like to take it and move it to a folder that I will make accessible from the firewall to feed the ip blocking rules

Thanks

[Julio Gasco]

Hi Matteo,

The exports will be created and ready to be downloaded from the Reporting section as seen below

The reports are saved at a index level so they are not created in the server until you download them. 

So you would need to get into Reporting section and download them in order to be available. They are then saved at your browser´s pre-defined download location.

Regarding your question on only filtering some fields of the CSV, it is not possible at this moment, Kibana let´s you use "Selected fields" For the saved query, but it´s only intended for Visualization purposes, when you export that information all the fields will be showing anyway as it’s not affected by the “Selected fields” option.

Regards!

[Matteo]

Thanks a lot