https://community.splunk.com/t5/Splunk-Enterprise-Security/What-is-the-best-way-to-build-searches-and-alerting-in-a-Hyper-V/m-p/642572#M11507 <P>What is the best way to deal with building searches and alerting in a Hyper-V environment in which VMs pull MAC address from a pool controlled by the cluster nodes?&nbsp; Is setting all of my VMs to use static MAC addresses best practice (this is a large undertaking and would require maintenance) or is there a better way to do this?&nbsp; Should I rely on another variable to track these assets?</P> Tue, 09 May 2023 06:07:44 GMT gg74 2023-05-09T06:07:44Z https://community.splunk.com/t5/Splunk-Enterprise-Security/What-is-the-best-way-to-build-searches-and-alerting-in-a-Hyper-V/m-p/642572#M11507 <P>What is the best way to deal with building searches and alerting in a Hyper-V environment in which VMs pull MAC address from a pool controlled by the cluster nodes?&nbsp; Is setting all of my VMs to use static MAC addresses best practice (this is a large undertaking and would require maintenance) or is there a better way to do this?&nbsp; Should I rely on another variable to track these assets?</P> Tue, 09 May 2023 06:07:44 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/What-is-the-best-way-to-build-searches-and-alerting-in-a-Hyper-V/m-p/642572#M11507 gg74 2023-05-09T06:07:44Z https://community.splunk.com/t5/Splunk-Enterprise-Security/What-is-the-best-way-to-build-searches-and-alerting-in-a-Hyper-V/m-p/642594#M11508 <P>If you want a deterministic way to track assets, don't use a non-deterministic way of identifying the assets.</P> Tue, 09 May 2023 06:10:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/What-is-the-best-way-to-build-searches-and-alerting-in-a-Hyper-V/m-p/642594#M11508 ITWhisperer 2023-05-09T06:10:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/What-is-the-best-way-to-build-searches-and-alerting-in-a-Hyper-V/m-p/642646#M11509 <P>Is there a better variable to use than the MAC address?&nbsp; Something that doesn't rely on manual intervention to set?&nbsp; Is the GUID or device name the standard?&nbsp; Just looking options I may not be aware of.</P> Tue, 09 May 2023 11:55:57 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/What-is-the-best-way-to-build-searches-and-alerting-in-a-Hyper-V/m-p/642646#M11509 gg74 2023-05-09T11:55:57Z https://community.splunk.com/t5/Splunk-Enterprise-Security/What-is-the-best-way-to-build-searches-and-alerting-in-a-Hyper-V/m-p/642648#M11510 <P>It depends how your assets are set up - often a qualified host name is unique (enough) in your environment to distinguish between different hosts.</P> Tue, 09 May 2023 12:06:55 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/What-is-the-best-way-to-build-searches-and-alerting-in-a-Hyper-V/m-p/642648#M11510 ITWhisperer 2023-05-09T12:06:55Z