All Apps and Add-ons

Help creating two CWS searches

dzejsonborn
New Member

Hi, I am quite new with SPL searches and I need to urgently create the below searches, anyone can help?

- executable files download (.exe should be excluded due to the amount)

- big uploads made by users to external hosts

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Assuming you have data available about the uploads and download made by users, both searches are possible. See the Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435/) for examples.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming you have data available about the uploads and download made by users, both searches are possible. See the Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435/) for examples.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!