get_web_session_information_via_session_id.yml

name: Get Web Session Information via session id
id: bc91a8cf-35e7-4bb2-1120-e756cc06fd89
version: 1
date: '2018-10-08'
author: Bhavin Patel, Splunk
type: Investigation
status: deprecated
description: This search helps an analyst investigate a notable event to find out
  more about a specific web session. The search looks for a specific web session ID
  in the HTTP web traffic and outputs the URL and user agents, grouped by source IP
  address and HTTP status code.
search: '`stream_http` session_id  = $session_id$ | stats values(url) values(http_user_agent)
  by src_ip status'
how_to_implement: This search leverages data extracted from Stream:HTTP. You must
  configure the HTTP stream using the Splunk Stream App on your Splunk Stream deployment
  server.
known_false_positives: ''
references: []
tags:
  analytic_story:
  - Web Fraud Detection
  product:
  - Splunk Phantom
  security_domain: network