Splunk Enterprise Security

Add additional log types to a dataset

nb1030
New Member

In the Threat Activity Detected IR correlation search, it calls for stuff from the "Threat Intelligence" Data Model. As an example, an IP has been found to be malicious, and it only reports on DNS logs within my environment. What do I need to do to the "IP Intel" Dataset to have it include logs from my firewall? Would I just need to add "index=checkpoint sourcetype=opsec" to the current base search for "IP Intel"? What I am trying to accomplish is to have the results not only show the DNS logs for that IP, but also include the firewall logs. This way I can have the alert only fire when it sees DNS and a connection outbound to that IP. Any help would be greatly appreciated.

0 Karma

nb1030
New Member

Another example why I need to figure this out, are that any correlation searches that state "from datamodel" dealing with windows events are only giving me logs from one index, "winevent". I also have an index "dc_winevent" and one called "rc_winevent". Why are these not being searched\parsed out by the datasets? How do I add them?

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...