# Fixit
In this challenge room, you will act as John, who has recently cleared his third screening interview for the SOC-L2 position at MSSP Cybertees Ltd, and a final challenge is ready to test your knowledge, where you will be required to apply the knowledge to FIX the problems in Splunk. You are presented with a Splunk Instance and the network logs being ingested from an unknown device.
Pre-requisites\
This challenge is based on the knowledge covered in the following rooms:
* [Regex](https://tryhackme.com/room/catregex)
* [Splunk: Exploring SPL](https://tryhackme.com/room/splunkexploringspl)
* [Splunk: Data Manipulation](http://tryhackme.com/jr/splunkdatamanipulation)
### Challenge: FIXIT
This challenge is divided into three levels:
### **Level 1: Fix Event Boundaries**
Fix the Event Boundaries in Splunk. As the image below shows, Splunk cannot determine the Event boundaries, as the events are coming from an unknown device.
### **Level 2: Extract Custom Fields**
Once the event boundaries are defined, it is time to extract the custom fields to make the events searchable.
* Username
* Country
* Source\_IP
* Department
* Domain
### Sample Logs:
To create regex patterns, sample Network logs are shown below:
```c
[Network-log]: User named Johny Bil from Development department accessed the resource Cybertees.THM/about.html from the source IP 192.168.0.1 and country
Japan at: Thu Sep 28 00:13:46 2023
[Network-log]: User named Johny Bil from Marketing department accessed the resource Cybertees.THM/about.html from the source IP 192.168.2.2 and country
Japan at: Thu Sep 28 00:13:46 2023
[Network-log]: User named Johny Bil from HR department accessed the resource Cybertees.THM/about.html from the source IP 10.0.0.3 and country
Japan at: Thu Sep 28 00:13:46 2023
```
### Level 3: Perform Analysis on the FIXED Events
Once the custom fields are parsed, we can use those fields to analyze the Event logs. Examine the events and answer the questions.
Now our first task is to fix the event boundaries in Splunk because Splunk cannot determine the Event boundaries, as the events are coming from an unknown device.
In order to fix this issue, we can use different `stanzas` in the `props.conf` file. If we run the script a few times to observe the output, we can see that each event starts with the term `[Network-log]`, indicating the start of the event. We can use this as the regex pattern with the stanza `BREAK_ONLY_BEFORE` and see if it could fix this problem.
```
[network_logs]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = \[Network-log\]
```
Let’s restart Splunk to apply the changes.
```
/opt/splunk/bin/splunk restart
```
```
index=main sourcetype="network_logs"
```
Great. See, now Splunk is able to break the event exactly how it was intended.
1\) What is the full path of the FIXIT app directory?
Answer: /opt/splunk/etc/apps/fixit
2\) What Stanza will we use to define Event Boundary in this multi-line Event case?
Answer: BREAK\_ONLY\_BEFORE
3\) In the inputs.conf, what is the full path of the network-logs script?
Answer: /opt/splunk/etc/apps/fixit/bin/network-logs
4\) What regex pattern will help us define the Event's start?
Answer: \[Network-log]
Let’s proceed to extract fields such as Username, Country, Source IP, Department, and Domain.
```c
[Network-log]: User named Johny Bil from Development department accessed the resource Cybertees.THM/about.html from the source IP 192.168.0.1 and country
```
Now, let’s create a `transforms.conf` in the default folder of the DataApp directory, and put the following configurations in it as it is.
```
[network_log_extractions]
REGEX = \[Network-log\]:\sUser\s+named\s+([\w\s]+)\s+from\s+(\w+)\s+department\s+accessed\s+the\s+resource\s+([\w]+\.[\w]+\/[\w\-]+\.[\w]+)\s+from\s+the\s+source\s+IP\s+(\d{1,3}(?:\.\d{1,3}){3})\s+and\s+country\s+(\w+)(?=\s+at:)
FORMAT = Username::$1 Department::$2 Domain::$3 Source_IP::$4 Country::$5
WRITE_META = true
```
We need to update the props.conf to mention the recent updates we did in transforms.conf.
```
[network_logs]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = \[Network-log\]
TRANSFORMS-network_log = network_log_extractions
```
The next step would be to create fields.conf and mention the field we are going to extract from the logs.
```
[Username]
INDEXED = true
[Country]
INDEXED = true
[Source_IP]
INDEXED = true
[Department]
INDEXED = true
[Domain]
INDEXED = true
```
That’s all we need in order to extract the custom fields. Now, restart the Splunk instance so that the changes we have made are committed.
5\) What is the captured domain?
Answer: Cybertees.THM
6\) How many countries are captured in the logs?
Answer: 12
7\) How many departments are captured in the logs?
Answer: 6
8\) How many usernames are captured in the logs?
Answer: 28
9\) How many source IPs are captured in the logs?
Answer: 52
10\) Which configuration files were used to fix our problem? \[Alphabetic order: File1, file2, file3]
Answer: fields.conf, props.conf, transforms.conf
11\) What are the TOP two countries the user Robert tried to access the domain from? \[Answer in comma-separated and in Alphabetic Order]\[Format: Country1, Country2]
Answer: Canada, United States
**12)** Which user accessed the secret-document.pdf on the website?
Answer: Sarah Hall
.png?alt=media&token=3b44cf25-7c3d-43a5-934e-7fa3b55388a4)
.png?alt=media&token=ac175bba-ca9d-462e-a6c9-2f84737e9317)
.png?alt=media&token=cda23706-a487-426e-b456-d0d162f2e96f)
.png?alt=media&token=b0048ce4-27e7-4678-aea0-ab9e144602eb)
.png?alt=media&token=9b9abf84-fbd8-4067-91b6-e8713f481245)
.png?alt=media&token=86dd729d-bbd6-4601-a2c6-3d0443a7b23b)
.png?alt=media&token=29b8a9c9-d6e9-4b5c-acd8-1dd3261ecc46)
.png?alt=media&token=1fbca39b-367c-441f-8a3e-05556e0e9275)