topic Re: how do I make splunk es to check my uploaded logs in Splunk Enterprise Security

how do I make splunk es to check my uploaded logs

testttt — Wed, 05 Jun 2024 11:09:34 GMT

I have installed splunk es app and uploaded botsv1.stream_http.json (https://github.com/splunk/attack_data)

but incident_review and ess_security_posture is not hitting any event

how do I make splunk es to check my uploaded logs and generate a list of alerts like below. Please note that I am not checking the logs forwarded by agent, but the log files uploaded on the browser side

thank you

Re: how do I make splunk es to check my uploaded logs

kiran_panchavat — Wed, 05 Jun 2024 16:32:29 GMT

@testttt There are no notable events that you can produce because you have uploaded sample events to Splunk. Could you please create an instance, send the logs to Splunk, and attempt to produce the notable events? such as unsuccessful login attempts and bruteforce attacks.

Re: how do I make splunk es to check my uploaded logs

testttt — Thu, 06 Jun 2024 09:00:27 GMT

I created a dvwa application and used SplunkUniversalForwarder to forward the log to port 9997, containing events such as sql injection and brute force cracking,

but incident_review and ess_security_posture is not hitting any event