Splunk Enterprise Security

Community Activity

Comparison of Splunk enterprise and Splunk enterprise security HI! Is Splunk enterprise security contains all the features of Splunk enterprise as well other than its advanced sec... by aqudoos Explorer in Splunk Enterprise Security 07-30-2018 0 2	0	2
Splunk Enterprise Security: Why do I receive "command="xswhere", [Errno 13] Permission denied" error when trying to perform a correlation search? Hello, some correlation searches don't trigger. when I copy the search and tried to run on search window, I am gettin... by deepu123 Explorer in Splunk Enterprise Security 07-30-2018 0 2	0	2
UF installation on 2016 Symantec Server Installation fails on 2016 SEP server. I've disable local SEP protection and ran the installation as admin from the c... by whinkle New Member in Splunk Enterprise Security 07-30-2018 0 0	0	0
Self study resources for certification Hi, I want to get certification in spunk as a splunk admin and architect. I would like to know about the study mater... by waqaskhan_778 New Member in Splunk Enterprise Security 07-27-2018 0 1	0	1
Do I have to disable asset_lookup_by_cidr? Hi Splunkers, In our alerts related to Network domain (IDS, netflow, etc), where in logs there's only IP address ava... by evelenke Contributor in Splunk Enterprise Security 07-27-2018 0 2	0	2
How to make a graph of the following query Hi team! It's my very first time with Splunk and I need help. This is my query and I would like to make a graph tha... by christianubeda Path Finder in Splunk Enterprise Security 07-27-2018 0 4	0	4
ES - Completely Inactive Account false positive alerts? Hi, I am trying to clean out a little the correlation alerts in ES. Currently focusing on the Completely Inactive Ac... by ikulcsar Communicator in Splunk Enterprise Security 07-26-2018 0 1	0	1
Splunk Enterprise Security - How to use the Incident Review event page I have an incident which reads - "Activity from Expired User Identity" CRITICAL Please can someone work me through ho... by Tightech New Member in Splunk Enterprise Security 07-26-2018 0 2	0	2
I would like to create a Workflow action (using a POST link) using the rule_title field and cannot figure out how to expand the tokens in the field. When constructing the post data from a Notable Event in Enterprise Security Incident Review dashboard as an event act... by joelstucki Engager in Splunk Enterprise Security 07-25-2018 0 1	0	1
Splunk port scan detection Hi team! It's my very first time and I need help. I want to detect a port scan. I did that but I dont know how to c... by christianubeda Path Finder in Splunk Enterprise Security 07-25-2018 0 4	0	4
IIS and ES application & CIM Hello, I have set up ES and I am trying to input information from IIS. While the information is being parsed correc... by dimitris_vergos Path Finder in Splunk Enterprise Security 07-25-2018 0 4	0	4
Is there a troubleshooting guide for Enterprise Security or ITSI specifically? Is there a troubleshooting guide for Enterprise Security or ITSI specifically? I know that Splunk has a manual for ... by natalienguyen Explorer in Splunk Enterprise Security 07-23-2018 0 3	0	3
Where should the Cisco AMP for Endpoints Add-Ons be installed? Where should the "Cisco AMP for Endpoints CIM Add-On" and the "Cisco AMP for Endpoints Events Input" be installed? H... by kshuttleworth Engager in Splunk Enterprise Security 07-22-2018 0 1	0	1
Why is our Splunk-ES iplocation src returning 192.168.xxx.xxx addresses in the "Access Anomalies" dashboard? Why is our Splunk-ES iplocation src returning 192.168.xxx.xxx addresses in the "Access Anomalies" dashboard? Why is... by ChadLangUAB Path Finder in Splunk Enterprise Security 07-19-2018 0 3	0	3
How do I call a non-Splunk REST API in an Event Action? Microsoft Exchange Online has an API available to return Message Details of an email. There's currently an app in Spl... by dpanych Communicator in Splunk Enterprise Security 07-19-2018 0 0	0	0
Problem dynamically specifying colors in specific order - geomapping sequential/categorical Hey fellow Splunkers. I'm working on mapping some of my data and ran into a bit of a snag.. With the first search exa... by opsniper New Member in Splunk Enterprise Security 07-18-2018 0 0	0	0
Can you update the default collection or create a custom collection of swimlanes for the investigator dashboards for Splunk Enterprise Security? Is there a way to update the default collection or create a custom collection of swimlanes for the investigator dashb... by AndySplunks Communicator in Splunk Enterprise Security 07-17-2018 1 6	1	6
How to modify field values? Hi I have the following fields (FileName and FileSize) that I'd like to turn into the example table below. How can ... by Splunkuser18 Engager in Splunk Enterprise Security 07-16-2018 0 4	0	4
incorrect query field of dat_version ……. [EPOEvents].[AnalyzerVersion] as [product_version], [EPOEvents].[AnalyzerEngineVersion] as [engine_version], [E... by quentinwl_chung New Member in Splunk Enterprise Security 07-15-2018 0 0	0	0
Getting null values for some events for O365 messagetrace events Getting null values of some event fields for sourcetype="ms:o365:reporting:messagetrace" , data is onboraded via Mic... by Dev_Choudhary Path Finder in Splunk Enterprise Security 07-13-2018 0 1	0	1
adaptive response action handling multiple results Hello, A question about "Example adaptive response action" given in dev.splunk.com/view/enterprise-security/SP-CAAAF... by ibmresilient Path Finder in Splunk Enterprise Security 07-12-2018 0 1	0	1
Windows Events to Epoch My goal was to filter out Windows Security Events Event Code 4616 for entries that were less than a second. I thought... by dakkmaddy Engager in Splunk Enterprise Security 07-11-2018 1 0	1	0
Mac OS high sierra USB monitoring Is there a way to Monitor USB activity for all Mac books and systems on an enterprise level? For example maybe use lo... by johns0n1216 New Member in Splunk Enterprise Security 07-11-2018 0 2	0	2
How to make an incident review dashboard based on how many cases are open and resolved on the month. Hi All, I am trying to create a dashboard for notable events that has been opened on the month and how many events c... by iwanwibisonoadh New Member in Splunk Enterprise Security 07-10-2018 0 5	0	5
Top Notable Event regarding Potential Security Risks I have searched across Splunk Answers, Docs, and the YouTube channel but I haven't found nothing of interesting so I'... by tommaso_marsico New Member in Splunk Enterprise Security 07-10-2018 0 0	0	0