topic Re: [Splunk Content] Xp_cmdshell enablement rule error in content management in Splunk Enterprise Security

[Splunk Content] Xp_cmdshell enablement rule error in content management

nooproblems — Thu, 27 Nov 2025 15:57:20 GMT

On Splunk ES I’m having an issue with the rule “Windows SQL Server xp_cmdshell Config Change” (https://research.splunk.com/endpoint/5eb76fe2-a869-4865-8c4c-8cff424b18b1/).
After enabling it, I can no longer disable or delete the rule.

I created a custom rule equivalent to that one with the search:
index=wineventlog EventCode=15457 "*xp_cmdshell*"
and it encounters the same issue. Even when I manually run the search
index=wineventlog EventCode=15457 "*xp_cmdshell*",
Splunk reports an error. I’m not sure what the underlying issue is. I’m wondering if anyone has encountered this problem before.

Please help me disable or delete this rule, and let me know what the root cause of the issue might be.

Re: [Splunk Content] Xp_cmdshell enablement rule error in content management

livehybrid — Thu, 27 Nov 2025 22:11:33 GMT

Hi @nooproblems

It seems there is something odd going on with the response received from the API call to disable the rule, can you open the browser's Developer Console and click the Network tab, then try the disable action and see if you see a non-200 status API call, if you click in the Response tab is there anything which indicates what could be going on?

It could be a coincidence that its since enabling this rule (but not necessarily!) but the output from the API call would be helpful in determining the issue.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing