Splunk Enterprise Security

Splunk App for Enterprise Security: Is it possible to limit my search of the Intrusion Detection datamodel to only IPS events and exclude firewall events?

may_aaron
Engager

I want to create a single value chart to illustrate total intrusion detection events, however, I want to limit the results to our IPS threat events and exclude our firewall threat events. Is this possible to do this? Also, are there any good resources for understanding the datamodel search syntax? I've reviewed the Splunk documentation, but I didn't find it very helpful.

0 Karma

sowings
Splunk Employee
Splunk Employee

Certainly; you could modify the data model itself to include a base-level filter string (like "sourcetype=my_ips_sourcetype") in the base event filter. Not recommended, but possible. Note that in future versions of ES, you'll be able to easily provide (with UI workflow) a list of indexes to consider. In this way, you could constrain the model to only search the index where the IDS / IPS data live, and ignore the firewall index.

Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...