The Event Query is a feature introduced from the version 5 that permit to perform SQL style queries from events or logs

Query Purpose

The utilization of queries offers numerous benefits, primarily due to their exceptional speed as a result of the direct access they have to the database where the events are stored.

The primary reasons for utilizing these queries include:

• To replace a LCE Rule
• Generate a statistic (temporary or permanent)
• Generate an event based on a specific event threshold
• Generate an e-mail alert or setup other action triggered by the query

Query Basics

You can follow this KB in order to achieve the basic first-step syntax and compose the very first query: SGBox – Events Queries Basics

Also more details about query directly from logs: SGBox – Events Queries from Raw Logs

Query Options

• 🕑 Interval: monitor window where the query looking for (5 minutes in the example). You can find this option in the scheduling options
  
• 📅 Active Scheduling: Query scheduled will run every minute
  

A timeline summary of the two options combined:

Join

If you need to correlate two different events, and use different WHERE condition in the two query, you can later combine it using the “Join Query” panel.
Here you can define the two query

More details and example you can find it in this KB article:

Advanced Syntax

In a query you can use various functions, as decribed in the list below

Column alias

Every parameter, represented as a column, can be aliased with a name.

The general syntax is:
column AS aliasname
where column can be $TIMESTAMP, $HOST, $EVENT, or any $PARAM:*

The use of the alias is a best practice that permit also to pre-calculate the value in a column, to use it later in the WHERE or FINALLY statement.

Note: some column alias are forbidden to use: ts, Pattern, pid, hid

Functions and Statements

Complex Example
SELECT

count() as cnt,
max($TIMESTAMP) as lastlog,
sum($PARAM:[packetsize]) as totalsize,
extract($PARAM:[longmessage], 'beforetext: (\w+ mystringtocatch) ') as extractedMsg

FROM ()

WHERE

(

extractedMsg LIKE '%anytext%'

OR match($PARAM:[longmessage], 'anyotherstring')

OR extractedMsg IN ('fixedvalue1', 'fixedstring2')

)

AND NOT totalsize > 500

FINALLY

GROUP BY totalsize, extractedMsg

HAVING count() > 10

ORDER BY cnt DESC, lastlog



Troubleshooting

Convert Event Queries as Report

There are two main way to generate (or schedule) a Report starting by an Event Queries

Using dashboard

The steps to follow:

1. Generate query (pay attention to order the result correctly with the ORDER BY directive)
2. Associate the event query to a new specific dashboard
3. Schedule the newly created dashboard as Report

Note: the report will generate only a pdf type attachment. To generate a tabular (csv) report you must use the second solution

By creating a new event

1. Generate query and output event as action (define event name and class)
2. Schedule the report starting by the newly class created

Event Queries to generate Widget in Dashboard

Some Event Queries can be used as base to fill up widget on dashboard

On dashboard, in the Add Widget Menu

Next in the new window you can manage the source Event Query and the visualization tipology

To build up the correct query syntax to match the correct type, please check the next chapter

Table

You can build any type of query to show up as table, only pay attention to the size of the single columns, as in the widget may can be limited or truncated.

Example

Pie, Cloud

Any number of columns, but the last column must be numeric (used to build up the slice of the pie).

Example

SELECT
    $EVENT as evt, count() as cnt
FROM 4 events on all hosts
FINALLY
    GROUP BY evt

or

SELECT
    count() as Count, $EVENT as evt, count() as cnt
FROM 4 events on all hosts
FINALLY
    GROUP BY evt

Column

First column is the value in X axis.
Other columns must be numeric value, as there are the numeric series.

Example

SELECT
    $EVENT as evt, count() as cnt
FROM 4 events on all hosts
FINALLY
    GROUP BY evt

or

SELECT
    $EVENT as evt, count() as cnt, count()+100 as cnt100
FROM 4 events on all hosts
FINALLY
    GROUP BY evt

Map

First column must be an IP address value.
Second must be numeric (typically count).

Example

SELECT
    $PARAM:[SourceIP] as SourceIP, count() as cnt
FROM 4 events on all hosts
FINALLY
    GROUP BY SourceIP

Timeline

First column must be a Timestamp value (datetime value).
Second is a string value used for the legend.
Last column must be a number (used for the point)

Example

SELECT
    $TIMESTAMP as timestamp, $EVENT as evt, $PARAM:[HttpStatuscode]
FROM 4 events on all hosts

or

SELECT
    $TIMESTAMP as timestamp, $EVENT as Evt, $PARAM:[HTTPSize] as Size, toUInt8($PARAM:[HTTPSize])+100 as avgsize
FROM 4 events on all hosts

or

SELECT
    $TIMESTAMP as ts, $PARAM:[UserName] as User, count() as cnt
FROM 1 event on all hosts
FINALLY
    GROUP by ts,User

Text (Notes)

Fixed value in a row and a column.

Example

SELECT
    'test' as text
FROM all events on 127.0.0.1

or

SELECT
    count() as count
FROM 4 events on all hosts

This article explain how to configure the Log Queries functionality, that allows you to obtain any data on SGBox logs. This queries can use to send alerts, create events or run a Playbook.

Requirements:

• SGBox version 5.5.4

From SGBox menu, go to LM> Analysis > Events Queries and select New Query and select Logs
Use SQL syntax to write query sections:

• SELECT: you can use placeholders $TIMESTAMP, $HOST, $LINE.
• FROM: you to select hosts on which to perform the query.
• WHERE: you can filter the value $LINE.
• FINALLY: additional information to complete the query like GROUP or LIMIT

You can now SAVE or TEST your query. Here the result:

The Risk Analysis is different way to show the information collected by the different hosts. Using this view is possible to identify witch hosts, assets, networks, are critical than others based on the events happened on the different hosts.

Requirements:

• SGBox Version 4.2.1.

You can define a specific score (from 0 to 10) on each event you recognize in SGBox from LM > Configuration > Events families.
Here you can find Families and Subfamilies:

• Families: a group that contains different subfamilies.
• Subfamilies: a group that contains same events.

You can use the pre configured or you can create your own Families or Subfamilies and assign a specif score. As you can see below Logon successful, Logoff and Logon failed belong to Authentication family. Logon Successful and Logoff have a score of 1. Logon fail has a score of 3. So it means the Logon fail is more critical that a Logon successful.

Example:

• The host A receives 1 Logon OK, The host B receives 3 Logon fails.
• The host A belongs to asset A & network A. The host B belongs to asset B & network B.

The host B is more critical than the Host A, the asset B is more critical than the asset A, the network B is more critical than the network A, based on the events occurred.
The score assigned to the Subfamily is not the final score, is just a level of criticity. Other mathematical operation has been made by SGBox in order to determinate the Critical level.

You can also visualize the information obtained in a Risk Analysis dashboard.
From SCM > Dashboard > Dashboard. Select Dashboard > Create New Dashboard > New Widget then Risk Analysis from the provided menu.