Splunk Enterprise Security

Help with query to find out activity towards a particular URL

cyber_Maddy
Engager

query to find out activity towards a particular URL

eg: URL - https://www.microsoft.com/en-us/security

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What events do you have available to search?

What sort of activity are you trying to discover?

0 Karma

cyber_Maddy
Engager

There is a malicious website Eg: https://xxxx.xxxx.com

I just wanted to find out if anybody tried to access the URLhttps://xxxx.xxxx.com  from my organization or any communication from the malicious URL https://xxxx.xxxx.com to our network.

Firewall , Crowdstrike - are the available data

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...