Splunk Enterprise Security

Splunk App for Enterprise Security: Is it possible to limit my search of the Intrusion Detection datamodel to only IPS events and exclude firewall events?

may_aaron
Engager

I want to create a single value chart to illustrate total intrusion detection events, however, I want to limit the results to our IPS threat events and exclude our firewall threat events. Is this possible to do this? Also, are there any good resources for understanding the datamodel search syntax? I've reviewed the Splunk documentation, but I didn't find it very helpful.

0 Karma

sowings
Splunk Employee
Splunk Employee

Certainly; you could modify the data model itself to include a base-level filter string (like "sourcetype=my_ips_sourcetype") in the base event filter. Not recommended, but possible. Note that in future versions of ES, you'll be able to easily provide (with UI workflow) a list of indexes to consider. In this way, you could constrain the model to only search the index where the IDS / IPS data live, and ignore the firewall index.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...