topic Re: H classification is Threat, even though I chose endpoin in All Apps and Add-ons

H classification is Threat, even though I chose endpoin

tuts — Wed, 10 Jul 2024 19:58:42 GMT

Hello everyone, I do not know why the classification is Threat, even though I chose endpoin

Re: H classification is Threat, even though I chose endpoin

gcusello — Thu, 11 Jul 2024 06:04:17 GMT

Hi @tuts ,

go in the ES menu item [Settings > Configure > Contents]

choose the related Correlation Search and see in the Notable Section what's the configured Security Domain.

probably the Threat Security Domain is associated to your Correlation Search and it's bundled in the CS name.

In this case you have to clone the CS, using the correct Security Domain and delete the old one.

Ciao.

Giuseppe

Re: H classification is Threat, even though I chose endpoin

tuts — Thu, 11 Jul 2024 07:12:54 GMT

Welcome to you engineer I did not understand where to go can you explain to me more I am new to splunk and about two months I am looking for a solution to the problem

Re: H classification is Threat, even though I chose endpoin

tuts — Thu, 11 Jul 2024 07:21:30 GMT

I really don't know what to do, all I want is to adopt the security domains that I want

Re: H classification is Threat, even though I chose endpoin

tuts — Thu, 11 Jul 2024 08:12:13 GMT

This is the search, but whatever you choose from a domain, it categorizes it as a threat

Re: H classification is Threat, even though I chose endpoin

gcusello — Thu, 11 Jul 2024 08:44:40 GMT

Hi @tuts ,

as I said, the Threat Security Domain is in the name of the Correlation Search.

Clone your CS and change the Security Domain.

You'll have a new CS with the correct name.

Ciao.

Giuseppe

Re: H classification is Threat, even though I chose endpoin

tuts — Thu, 11 Jul 2024 08:51:09 GMT

here

Re: H classification is Threat, even though I chose endpoin

tuts — Thu, 11 Jul 2024 08:59:25 GMT

I am new in this field, is it possible to explain the solution step by step?

Re: H classification is Threat, even though I chose endpoin

tuts — Thu, 11 Jul 2024 09:02:59 GMT

If you mean that, I did it and still have the same problem.

Re: H classification is Threat, even though I chose endpoin

gcusello — Thu, 11 Jul 2024 09:05:49 GMT

Hi @tuts ,

please try this:

from the list of the Correlation Searches, clone your one (link on the right side),
edit the new Correlation Search using the correct Security Domain,
Save it.
disable and then delete the old Correlatin Search.

Ciao.

Giuseppe

Re: H classification is Threat, even though I chose endpoin

tuts — Thu, 11 Jul 2024 09:23:31 GMT

I did the same steps and still have the same problem

Re: H classification is Threat, even though I chose endpoin

tuts — Thu, 11 Jul 2024 09:26:37 GMT

I did the same steps and still have the same problem