Splunk Enterprise Security

Add additional log types to a dataset

nb1030
New Member

In the Threat Activity Detected IR correlation search, it calls for stuff from the "Threat Intelligence" Data Model. As an example, an IP has been found to be malicious, and it only reports on DNS logs within my environment. What do I need to do to the "IP Intel" Dataset to have it include logs from my firewall? Would I just need to add "index=checkpoint sourcetype=opsec" to the current base search for "IP Intel"? What I am trying to accomplish is to have the results not only show the DNS logs for that IP, but also include the firewall logs. This way I can have the alert only fire when it sees DNS and a connection outbound to that IP. Any help would be greatly appreciated.

0 Karma

nb1030
New Member

Another example why I need to figure this out, are that any correlation searches that state "from datamodel" dealing with windows events are only giving me logs from one index, "winevent". I also have an index "dc_winevent" and one called "rc_winevent". Why are these not being searched\parsed out by the datasets? How do I add them?

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...