WhatsThis

Using the pywhat library by bee-san (https://github.com/bee-san/pyWhat), search through splunk events to find easy wins when looking for security related strings. All regex patterns are located at $APP_DIR/bin/pyWhat/Data/regex.json. Patterns can be added or taken away without restarting Splunk, as it is read every time at runtime. Using pywhat without specifying a field will default to using "_raw". At this time it only supports a single field at a time. Warning, this means additional uses of pywhat in a query will result in potentially lagged searches depending on size of data being streamed and individual hardware.