Solved: Help creating two CWS searches

dzejsonborn · ‎06-21-2019

Hi, I am quite new with SPL searches and I need to urgently create the below searches, anyone can help?

- executable files download (.exe should be excluded due to the amount)

- big uploads made by users to external hosts

richgalloway · ‎06-21-2019

Assuming you have data available about the uploads and download made by users, both searches are possible. See the Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435/) for examples.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎06-21-2019

Assuming you have data available about the uploads and download made by users, both searches are possible. See the Splunk Security Essentials app (https://splunkbase.splunk.com/app/3435/) for examples.

---
If this reply helps you, Karma would be appreciated.

Help creating two CWS searches

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

Splunk Community Badges!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

Join the Conversation