Integrate ChatGPT and Splunk in Sysmon Log Analysis

Integrate ChatGPT and Splunk in Sysmon Log Analysis

Integrate ChatGPT and Splunk in Sysmon Log Analysis

In this project, we attempt to use two add-ons of Splunk: “OB OpenAI ChatGPT” and “Sysmon Splunk Add-on for Microsoft Windows” to integrate Splunk and ChatGPT for analyzing Sysmon events, exploring the applications of artificial intelligence in incident response.

Tools

Tool version
Sysmon v15.0
Splunk Enterprise Server 9.1.0.1
ChatGPT ChatGPT-4 API
OB OpenAI ChatGPT 1.0.2
Splunk Add-on for Microsoft Windows 8.7.0

Process

Install Splunk

This project uses a trial version of Splunk Enterprise, which can be registered and downloaded from the official Splunk website.
https://www.splunk.com/en_us/download.html?301=/en_us/download/get-started-with-your-free-trial.html

Install Sysmon

Sysmon can be downloaded from Microsoft Sysinternal official website.
https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
After downloading Sysmon, you can easily install it with command:
./sysmon64.exe -i

Add Sysmon data into Splunk

To upload Sysmon events from Windows to Splunk, you need the Splunk add-on “Splunk Add-on for Microsoft Windows”.

Click Apps>Find more Apps on Splunk Menu.
enter image description here
Search: “Splunk Add-on for Microsoft Windows” and click install.
enter image description here

Login with your Splunk account and install.
enter image description here

Click Setting>Add-Data on the top menu.
enter image description here
Click Operating System.
enter image description here
Click Microsoft Windows.
enter image description here
Click Next.
enter image description here
Select Single Instence and click next.
enter image description here
Click Finish.
enter image description here
Click Setting>Data inputs.
enter image description here
Click “Local event log collection”.
enter image description hereSelect “Microsoft-Windows-Sysmon/Operational” and click Save.
enter image description here

Now you may have Sysmon log uploaded to Splunk.
Go to Splunk Search and Search with this query. See if you can get your Sysmon log.

index=main source="WinEventLog:Microsoft-Windows-Sysmon/Operational"
| head 1

enter image description here

Connect Splunk with ChatGPT

To connect Splunk with ChatGPT API, you need the Splunk add-on “OB OpenAI ChatGPT”.
Follow the same process of install Add-on on Splunk and install “OB OpenAI ChatGPT” with your Splunk account.
enter image description here
After downloading the OB OpenAI ChatGPT Add-on, you need to set up your ChatGPT Orgnization ID and API key.
Open the app> Configuration> Add-on Settings> paste you API key and Organization ID> Save.
Your Organization ID and API key and be found here:
https://beta.openai.com/account/org-settings
https://beta.openai.com/account/api-keys
enter image description here

Integrate ChatGPT and Splunk in Sysmon Log Analysis

Now, let’s try to send Sysmon events to ChatGPT and let it analyze it for you.

To customize or formating the ChatGPT response, role setting is an important thing.
The role I assigned to ChatGPT as following:

“You are a knowledgeable assistant specialized in sysmon data, provide a very brief summary, conclusion, risky score ? out of 100 and response recommendation. for the following Sysmon log events, no need to explain individual fields.”

The command is:

index=main source="WinEventLog:Microsoft-Windows-Sysmon/Operational"
| head 3
| rename _raw as r
| obopenai prompt=r system_role="You are a knowledgeable assistant specialized in sysmon data, provide a very brief summary, conclusion, risky score ? out of 100 and response recommendation. for the following Sysmon log events, no need to explain individual fields."
| spath input=gpt_response output=response_content path="choices{0}.message.content"
| table r response_content

I query 3 Sysmon events and rename the _raw field as r then send it to ChatGPT with the role I setted for ChatGPT.

Here is the result.
enter image description here
Although the answer is still a bit Generic, it seems acceptable for a preliminary Triage.

More ChatGPT Add-on usage can be found in the following article.
https://github.com/nadavc2c/TA-ob-openai-chatgpt

Comments

Post a Comment

Popular posts from this blog

PCAP analysis report - Nitroba University

Image
Introduction/objectives/Background Case Background Lily Tuckrige is teaching chemistry CHEM109 this summer at NSU and she has been receiving harassing email at her personal email address: lilytuckrige@yahoo.com. She suspects that they are being sent by a student in her class CHEM109. About this case, I received a packet capture files called "nitroba.pcap" containing the network traffic packets recorded from Nitroba student dormitories by a network sniffer and a slide called "slides.pdf". According to the document "slides.pdf" that I have received, the following information was provided: The email address used by victim Lily Tuckrige was “lilytuckrige@yahoo.com”, and she received the harassing emails at this address. The first harassing email was sent on Sun, 13 Jul 2008 17:21:01 -0700 from the email address “ nobody@nitroba.com ” with IP address “140.247.62.34”. The IP address points to a nitroba dorm room that shared by three women Alice, Barbara, and Can
Read more

Mason TCTF - Writeup (Update in progress)

Image
Welcome file Mason TCTF is an cyber security CTF (Capture the Flag) deployed by Mason Competitive Cyber (MasonCC), an cyber security group at George Mason University. The challenges include Threat Detection, Linux/Scripting, Protocol Hopping, Digital Forensics, Cryptography, Password Cracking, Steganography, Recon, and Web with difficulty ranging from simple to moderately complex. It is an good CTF for learning various aspects of cyber security knowledge. This write-up will document my thinking and process of solving the problem according to the category of the challenge. (Update in progress) The Office “The Office” category is an incident response scenario about ransomware. The solver needs to analyze the “LiveResponseData” dataset to get the flags of the 4 problems. #1 ASAP as Possible (150) Read the scenario, and then look at the forensic data to answer the questions. What was the name of the file that ran the ransomware? Remember to enter the flag in
Read more