Splunk Enterprise Security

Splunk App for Enterprise Security: Is it possible to limit my search of the Intrusion Detection datamodel to only IPS events and exclude firewall events?

may_aaron
Engager

I want to create a single value chart to illustrate total intrusion detection events, however, I want to limit the results to our IPS threat events and exclude our firewall threat events. Is this possible to do this? Also, are there any good resources for understanding the datamodel search syntax? I've reviewed the Splunk documentation, but I didn't find it very helpful.

0 Karma

sowings
Splunk Employee
Splunk Employee

Certainly; you could modify the data model itself to include a base-level filter string (like "sourcetype=my_ips_sourcetype") in the base event filter. Not recommended, but possible. Note that in future versions of ES, you'll be able to easily provide (with UI workflow) a list of indexes to consider. In this way, you could constrain the model to only search the index where the IDS / IPS data live, and ignore the firewall index.

Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...