All Apps and Add-ons

Seculert app for Splunk: How is the Summary lookup generated?

rgonzale6
Path Finder

There appears to be data in the Summary lookup file that's not in the raw data in the seculert_records index - at least not according to the timestamps in both.

How is this lookup generated?

0 Karma

doron_peri
New Member

Seculert detects malware communications from devices in your organization to command and control hosts.
The individual raw communication records are reported into Splunk as events, while the aggregate incidents of infected devices are reported in a Summary lookup.
Using lookup solves challenge of updating information in an incident entity such as the time it was last seen or its status (open, closed).
Records and incidents are linked through an incident id.

0 Karma

yannK
Splunk Employee
Splunk Employee
  • summary are populated by scheduled searched.

  • lookups are populated with scheduled searches, or by scripts.
    check for any search that contains "outputlookup"

0 Karma

rgonzale6
Path Finder

There are two scheduled saved searches for this app - neither is set to output to a summary index or an output file that populates this particular file.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...