All Apps and Add-ons

Seculert app for Splunk: How is the Summary lookup generated?

rgonzale6
Path Finder

There appears to be data in the Summary lookup file that's not in the raw data in the seculert_records index - at least not according to the timestamps in both.

How is this lookup generated?

0 Karma

doron_peri
New Member

Seculert detects malware communications from devices in your organization to command and control hosts.
The individual raw communication records are reported into Splunk as events, while the aggregate incidents of infected devices are reported in a Summary lookup.
Using lookup solves challenge of updating information in an incident entity such as the time it was last seen or its status (open, closed).
Records and incidents are linked through an incident id.

0 Karma

yannK
Splunk Employee
Splunk Employee
  • summary are populated by scheduled searched.

  • lookups are populated with scheduled searches, or by scripts.
    check for any search that contains "outputlookup"

0 Karma

rgonzale6
Path Finder

There are two scheduled saved searches for this app - neither is set to output to a summary index or an output file that populates this particular file.

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...