Splunk Enterprise Security

Community Activity

Self study resources for certification Hi, I want to get certification in spunk as a splunk admin and architect. I would like to know about the study mater... by waqaskhan_778 New Member in Splunk Enterprise Security 07-27-2018 0 1	0	1
Do I have to disable asset_lookup_by_cidr? Hi Splunkers, In our alerts related to Network domain (IDS, netflow, etc), where in logs there's only IP address ava... by evelenke Contributor in Splunk Enterprise Security 07-27-2018 0 2	0	2
How to make a graph of the following query Hi team! It's my very first time with Splunk and I need help. This is my query and I would like to make a graph tha... by christianubeda Path Finder in Splunk Enterprise Security 07-27-2018 0 4	0	4
ES - Completely Inactive Account false positive alerts? Hi, I am trying to clean out a little the correlation alerts in ES. Currently focusing on the Completely Inactive Ac... by ikulcsar Communicator in Splunk Enterprise Security 07-26-2018 0 1	0	1
Splunk Enterprise Security - How to use the Incident Review event page I have an incident which reads - "Activity from Expired User Identity" CRITICAL Please can someone work me through ho... by Tightech New Member in Splunk Enterprise Security 07-26-2018 0 2	0	2
I would like to create a Workflow action (using a POST link) using the rule_title field and cannot figure out how to expand the tokens in the field. When constructing the post data from a Notable Event in Enterprise Security Incident Review dashboard as an event act... by joelstucki Engager in Splunk Enterprise Security 07-25-2018 0 1	0	1
Splunk port scan detection Hi team! It's my very first time and I need help. I want to detect a port scan. I did that but I dont know how to c... by christianubeda Path Finder in Splunk Enterprise Security 07-25-2018 0 4	0	4
IIS and ES application & CIM Hello, I have set up ES and I am trying to input information from IIS. While the information is being parsed correc... by dimitris_vergos Path Finder in Splunk Enterprise Security 07-25-2018 0 4	0	4
Is there a troubleshooting guide for Enterprise Security or ITSI specifically? Is there a troubleshooting guide for Enterprise Security or ITSI specifically? I know that Splunk has a manual for ... by natalienguyen Explorer in Splunk Enterprise Security 07-23-2018 0 3	0	3
Where should the Cisco AMP for Endpoints Add-Ons be installed? Where should the "Cisco AMP for Endpoints CIM Add-On" and the "Cisco AMP for Endpoints Events Input" be installed? H... by kshuttleworth Engager in Splunk Enterprise Security 07-22-2018 0 1	0	1
Why is our Splunk-ES iplocation src returning 192.168.xxx.xxx addresses in the "Access Anomalies" dashboard? Why is our Splunk-ES iplocation src returning 192.168.xxx.xxx addresses in the "Access Anomalies" dashboard? Why is... by ChadLangUAB Path Finder in Splunk Enterprise Security 07-19-2018 0 3	0	3
How do I call a non-Splunk REST API in an Event Action? Microsoft Exchange Online has an API available to return Message Details of an email. There's currently an app in Spl... by dpanych Communicator in Splunk Enterprise Security 07-19-2018 0 0	0	0
Problem dynamically specifying colors in specific order - geomapping sequential/categorical Hey fellow Splunkers. I'm working on mapping some of my data and ran into a bit of a snag.. With the first search exa... by opsniper New Member in Splunk Enterprise Security 07-18-2018 0 0	0	0
Can you update the default collection or create a custom collection of swimlanes for the investigator dashboards for Splunk Enterprise Security? Is there a way to update the default collection or create a custom collection of swimlanes for the investigator dashb... by AndySplunks Communicator in Splunk Enterprise Security 07-17-2018 1 6	1	6
How to modify field values? Hi I have the following fields (FileName and FileSize) that I'd like to turn into the example table below. How can ... by Splunkuser18 Engager in Splunk Enterprise Security 07-16-2018 0 4	0	4
incorrect query field of dat_version ……. [EPOEvents].[AnalyzerVersion] as [product_version], [EPOEvents].[AnalyzerEngineVersion] as [engine_version], [E... by quentinwl_chung New Member in Splunk Enterprise Security 07-15-2018 0 0	0	0
Getting null values for some events for O365 messagetrace events Getting null values of some event fields for sourcetype="ms:o365:reporting:messagetrace" , data is onboraded via Mic... by Dev_Choudhary Path Finder in Splunk Enterprise Security 07-13-2018 0 1	0	1
adaptive response action handling multiple results Hello, A question about "Example adaptive response action" given in dev.splunk.com/view/enterprise-security/SP-CAAAF... by ibmresilient Path Finder in Splunk Enterprise Security 07-12-2018 0 1	0	1
Windows Events to Epoch My goal was to filter out Windows Security Events Event Code 4616 for entries that were less than a second. I thought... by dakkmaddy Engager in Splunk Enterprise Security 07-11-2018 1 0	1	0
Mac OS high sierra USB monitoring Is there a way to Monitor USB activity for all Mac books and systems on an enterprise level? For example maybe use lo... by johns0n1216 New Member in Splunk Enterprise Security 07-11-2018 0 2	0	2
How to make an incident review dashboard based on how many cases are open and resolved on the month. Hi All, I am trying to create a dashboard for notable events that has been opened on the month and how many events c... by iwanwibisonoadh New Member in Splunk Enterprise Security 07-10-2018 0 5	0	5
Top Notable Event regarding Potential Security Risks I have searched across Splunk Answers, Docs, and the YouTube channel but I haven't found nothing of interesting so I'... by tommaso_marsico New Member in Splunk Enterprise Security 07-10-2018 0 0	0	0
Force Threat Intelligence download Greetings, For ES, is there a way to force the threat intelligence feeds to download? I think they default run on a ... by matthewhintz New Member in Splunk Enterprise Security 07-10-2018 0 2	0	2
Splunk Enterprise Security: Adding exclusions to my Correlation Search for IPS? Splunk 6.5.1 Splunk Enterprise Security (ES) 4.2.0 I wrote the correlation search below (show sources that trigger m... by bwoltz New Member in Splunk Enterprise Security 07-10-2018 0 4	0	4
Sub search return value that's not in main search I have a Splunk sub search similar to index=index1 type="example" [ search index=index2 type="other" \| eval nowtime... by karthikmalla Explorer in Splunk Enterprise Security 07-09-2018 0 5	0	5