Splunk Enterprise Security

Community Activity

adaptive response action handling multiple results Hello, A question about "Example adaptive response action" given in dev.splunk.com/view/enterprise-security/SP-CAAAF... by ibmresilient Path Finder in Splunk Enterprise Security 07-12-2018 0 1	0	1
Windows Events to Epoch My goal was to filter out Windows Security Events Event Code 4616 for entries that were less than a second. I thought... by dakkmaddy Engager in Splunk Enterprise Security 07-11-2018 1 0	1	0
Mac OS high sierra USB monitoring Is there a way to Monitor USB activity for all Mac books and systems on an enterprise level? For example maybe use lo... by johns0n1216 New Member in Splunk Enterprise Security 07-11-2018 0 2	0	2
How to make an incident review dashboard based on how many cases are open and resolved on the month. Hi All, I am trying to create a dashboard for notable events that has been opened on the month and how many events c... by iwanwibisonoadh New Member in Splunk Enterprise Security 07-10-2018 0 5	0	5
Top Notable Event regarding Potential Security Risks I have searched across Splunk Answers, Docs, and the YouTube channel but I haven't found nothing of interesting so I'... by tommaso_marsico New Member in Splunk Enterprise Security 07-10-2018 0 0	0	0
Force Threat Intelligence download Greetings, For ES, is there a way to force the threat intelligence feeds to download? I think they default run on a ... by matthewhintz New Member in Splunk Enterprise Security 07-10-2018 0 2	0	2
Splunk Enterprise Security: Adding exclusions to my Correlation Search for IPS? Splunk 6.5.1 Splunk Enterprise Security (ES) 4.2.0 I wrote the correlation search below (show sources that trigger m... by bwoltz New Member in Splunk Enterprise Security 07-10-2018 0 4	0	4
Sub search return value that's not in main search I have a Splunk sub search similar to index=index1 type="example" [ search index=index2 type="other" \| eval nowtime... by karthikmalla Explorer in Splunk Enterprise Security 07-09-2018 0 5	0	5
need help with multivalue fields for chmod and find linux commands Good evening, I'm having trouble parsing this events as multivalue fields: Jun 18 01:05:00 : oracle : command not a... by 3DGjos Communicator in Splunk Enterprise Security 07-09-2018 0 3	0	3
Remove Search Head roles from an Indexer Hello to the community! I was wondering if there is any best practices regarding the removal of Search Head role fro... by andresito123 Communicator in Splunk Enterprise Security 07-06-2018 0 3	0	3
IS IIS and Apache logs of any use in enterprise security I was looking at our enterprise security and wondering weather IIS or apache logs are playing any significant role i... by ranjitbrhm1 Communicator in Splunk Enterprise Security 07-06-2018 0 0	0	0
Why are fields not being extracted running TA-squid with the Splunk App for Enterprise Security? Hi all, I am struggling with the field extractions in TA-squid. I have tried the TA-squid with Splunk 6.0 (which is... by btiggemann Path Finder in Splunk Enterprise Security 07-05-2018 0 2	0	2
Fortigate Active resposne Does anyone have any experience of the Fortigate active response - https://splunkbase.splunk.com/app/3444/ If so do ... by jsimpson New Member in Splunk Enterprise Security 07-05-2018 0 0	0	0
ES - Notables \| fetch correlated/contributing events for the triggered time in search app Hi, In incident review dashboard i have assigned some notables to me, instead of reviewing one by one i wanted to re... by CryoHydra Path Finder in Splunk Enterprise Security 07-04-2018 0 0	0	0
"notable events over time" panel is lagging behind the time I want to understand the irregular behaviour of output displays for "notable events over time" panel in ES. Right no... by saurabh_tek11 Communicator in Splunk Enterprise Security 07-04-2018 0 0	0	0
How to integrate BMC remedy asset management tool with splunk Hi, We have Splunk Enterprise 7.0.1 and BMC remedy 8.0 and wanted to integrate remedy asset management module with sp... by bc00509354 New Member in Splunk Enterprise Security 07-04-2018 0 0	0	0
Enterprise Security admin privileges, why We have a growing Splunk environment with one ES SH, and a SH cluster. We have an MSS that is going to manage our E... by tlmayes Contributor in Splunk Enterprise Security 07-03-2018 0 2	0	2
whitelist user account or windows service Hi, Is it possible to whitelist windows service(xyz.EXE) traffic in splunk or should I whitelist user account? by pradeep577 Path Finder in Splunk Enterprise Security 07-02-2018 0 0	0	0
How to maintain lookups? I am analyzing our Splunk set-up and was going through the lookups, need suggestions on the best strategy to maintain... by sidhantbhayana Path Finder in Splunk Enterprise Security 07-01-2018 0 2	0	2
Multivalue fields correlation How can I search for multiple values present in different fields? For example, I have fields titled FinalPurchases an... by bidemiologunde Engager in Splunk Enterprise Security 06-30-2018 1 4	1	4
Is there a way to modify an inputlookup subsearch from an implied equals operator to an "IN" operator? I have a subsearch doing "\| inputlookup" against a CSV... the implied operator is equals. "Column/Field = Cell Value"... by cogden Engager in Splunk Enterprise Security 06-30-2018 0 2	0	2
OpenLDAP add-on fields extraction I recently installed openldap add-on on both splunk cloud instance and splunk enterprise security instance https://s... by kevinleeV New Member in Splunk Enterprise Security 06-29-2018 0 6	0	6
Splunk architectural design - global search head Hi, I need someone to shed me some light on what is the best approach for me on changing my splunk architecture. Cur... by johant Explorer in Splunk Enterprise Security 06-28-2018 0 1	0	1
How to access Threat Grid thru workflow action in Enterprise Security Looking for a way to create a workflow action in ES, to research URL and IP addresses. by mrtolu6 Path Finder in Splunk Enterprise Security 06-28-2018 0 0	0	0
Feature Request: Pivot to Search App or Dashboard. Feature Request: Pivot to Search App or Dashboard. This would allow to leverage already created dashboards and ope... by jamesbanach New Member in Splunk Enterprise Security 06-26-2018 0 0	0	0