Splunk Enterprise Security

Community Activity

Per - result Alert I am a grad student and I recently gave a quiz on splunk. There was a true/false question.Q: Splunk Alerts can be cre... by rvnk Engager in Splunk Enterprise Security 10-27-2024 0 1	0	1
Throttling Notables - Do Underlying Alerts Need to be Throttled Too? Right now I have an issue with duplicate notables. I want to make it so a notable will only re-generate if there have... by hofer_emma Loves-to-Learn Lots in Splunk Enterprise Security 10-25-2024 0 0	0	0
How to create notable manually with selected timestamp? \| stats count \| eval _time="1685158808" \| eval rule_title="Test notable" \| eval security_domain="Network" \| e... by bluewizard Explorer in Splunk Enterprise Security 10-22-2024 0 3	0	3
Splunk Enterprise Security: Is it possible to implement multi-tenancy in a distributed search environment? Hello everybody. I deployed a Splunk Enterprise Security in a distributed environment for our customer. He also has... by jrballesteros05 Communicator in Splunk Enterprise Security 10-22-2024 1 9	1	9
Menu Bar Missing in Search and Reporting UI After Upgrade to 9.3.1- Splunk Enterprise I recently upgraded Splunk Enterprise from version 9.1.0.2 to 9.3.1, and I've encountered an issue where the menu bar... by sajith Loves-to-Learn in Splunk Enterprise Security 10-21-2024 0 5	0	5
Does the service now integration work as an ad hoc adaptive response? Hi guys, I have configured my servicenow integration with splunk and it works fine, we can create notables from any... by BGrdickson Explorer in Splunk Enterprise Security 10-17-2024 1 9	1	9
Update a notable once an incident is opened or closed in ServiceNow Hi All,Hope you all are doing well.I am very new to Splunk Enterprise security, and i need your help to understand h... by niks987 Explorer in Splunk Enterprise Security 10-17-2024 0 1	0	1
Error installing Splunk Security Essentials Hi all, I am trying to install Splunk Security Essentials into a single instance of Splunk with a downloaded file of ... by JackieTech Explorer in Splunk Enterprise Security 10-16-2024 0 14	0	14
How to configure Splunk Enterprise Security drill-down earliest offset? Hi, I'm trying to configure Drill-down Earliest Offset in my Notable from Adaptive Response Action. I'd like to run t... by martaBenedetti Path Finder in Splunk Enterprise Security 10-14-2024 0 7	0	7
Splunk ES taxii feed - AlienVault OTX config Hi everyone,Am having issues with the configuration of the AlienVault OTX feed in Splunk ES and would appreciate any ... by oz_dg Explorer in Splunk Enterprise Security 10-14-2024 2 7	2	7
How to make secure cookies in Splunk by setting Secure, SameSite, HTTPOnly Attributes? Hi everyone, Can you please help us to make the Secure cookies by doing below things. Setting HTTPOnly Flag to splu... by manikanthkoti Explorer in Splunk Enterprise Security 10-07-2024 1 1	1	1
Traffic Search function I've seen someone use this traffic search function but can't find it myself:How can I access this traffic search func... by brownbag Engager in Splunk Enterprise Security 10-03-2024 0 3	0	3
Documentation for SA-AccessProtection / DA-ESS-AccessProtection Greetings,I found some useful savedsearches under SA-AccessProtection / DA-ESS-AccessProtection, which I am intereste... by mjuestel2 Path Finder in Splunk Enterprise Security 10-02-2024 0 0	0	0
How to Format Dates in Splunk Email Reports for Improved Readability I'm trying to resolve an issue where Splunk sends email reports, but the information exported as an attachment uses a... by KingUs80 Loves-to-Learn Lots in Splunk Enterprise Security 09-30-2024 0 5	0	5
Autolookup How to fix"Could not load lookup=LOOKUP-autolookup_prices" by Joesplunk New Member in Splunk Enterprise Security 09-26-2024 0 1	0	1
Multi-Select in HTML for Alert Action does not return anything and does not show up in payload passed to python script I am using the following html for my alert action data entry screen. The tenant mulit-select does not show up in the... by jfournet New Member in Splunk Enterprise Security 09-23-2024 0 0	0	0
Where are Noteable Event Suppressions stored in Splunk? In Enterprise Security, you can configure Notable Event Suppressions. When adding/editing a suppression, which file ... by echojacques Builder in Splunk Enterprise Security 09-23-2024 0 7	0	7
For Enterprise Security, Threat Intelligence Management - What is the correct content of a STIX file? We are trying to ingest a STIX file into the Threat Intelligence Management, the STIX parses, but does not find anyth... by beano501 Explorer in Splunk Enterprise Security 09-22-2024 0 1	0	1
Search by id does not work in Incident Review When running a search on the Incident Review dashboard where the search term is the <event_id> value or event_id="<ev... by rbenbenish New Member in Splunk Enterprise Security 09-19-2024 0 0	0	0
URL Next step for notable Hi everyone!Is it possible to pass a parameter from search to the next "action\|url" step? Like in description: $resul... by user487596 Explorer in Splunk Enterprise Security 09-17-2024 0 0	0	0
Enterprise Security app We have a cluster with two search heads and two indexers. We need to install the Enterprise Security app on the searc... by hazem Path Finder in Splunk Enterprise Security 09-17-2024 0 2	0	2
After Updating to 9.2.2, ESS has stopped creating notables (ESS ver. 7.2.0) Hi,We were using Splunk Enterprise (8.2.5) and ESS (7.2.0) on Debian 12. Everything was working fine until I upgraded... by aluvian Loves-to-Learn Everything in Splunk Enterprise Security 09-16-2024 0 4	0	4
How to calculate MTTD in ES Hello Splunk ES experts , I want to make a query which will produce MTTD (something like by analyzing the time diffe... by vikas_gopal Builder in Splunk Enterprise Security 09-14-2024 0 4	0	4
Send Notable event _id to soar with notable alert Salam guysI wrote the Correlation Search Query and added the Adaptive Response Actions (notable, risk analysis and se... by kareem Explorer in Splunk Enterprise Security 09-14-2024 0 0	0	0
Palo log issue Hi all,I'm having issues comparing user field in Palo Alto traffic logs vs last user reported by Crowdstrike/Windows ... by Splunkers2 Observer in Splunk Enterprise Security 09-14-2024 0 3	0	3