Splunk Enterprise Security
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

alert triggered but ip not available in csv

srisahitya_v
Communicator
‎06-21-2018 08:02 AM

Hello Folks,

I have enabled a notable in ES_app, which triggers if it finds any ip available from local_ip_intel.csv.

Now I got a notable for one IP address, which I don't want it present in that list.

when I start searching, that IP is not available in local_ip_intel.csv.

but i can see a foot print in "ES_App"-->"Threat Artifacts"--> "network" dashboard with source path "/opt/splunk/etc/apps/DA-ESS-ThreatIntelligence/lookups/local_ip_intel.csv"

What might be causing, this false alert from ES_app where IP is not available in source csv file.

Reply
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...