Splunk Enterprise Security

Community Activity

How do I look for domains that aren't in the Alexa top 1 million? I am trying to find non-alexa top 1 million domain requests. I am getting alexa_by_str.csv from https://s3.amazonaws... by MonkeyK Builder in Splunk Enterprise Security 05-16-2018 0 13	0	13
Search string used for creating event type for data modelling marked as invalid search by Splunk I am working on aligning my own data to Splunk Enterprise Security's data model. Big error 1: I draft out my search... by gilbxrtx_7 New Member in Splunk Enterprise Security 05-16-2018 0 0	0	0
Disable TLS version 1.1 and below? I have a need to disable any version of tls below version 1.2. I've done this at the main splunk server, but there a... by trevisbecker New Member in Splunk Enterprise Security 05-15-2018 0 0	0	0
Why is the download link disabled in Symantec ATP Add-on for Splunk? Is it only me or the following apps are not downloadable : https://splunkbase.splunk.com/app/3454/ https://splunkbas... by praxis_mcvt New Member in Splunk Enterprise Security 05-15-2018 0 1	0	1
Splunk Enterprise Security: Is there a way to force a notable event to be critical? Is there a way to force a notable event in Splunk Enterprise Security to be critical? We have certain notables that ... by chiltonb Explorer in Splunk Enterprise Security 05-15-2018 0 7	0	7
Where I can find changes made related to log source or indexed data? Hi Guys I am looking for do a report on any log source or index setting was changed in last 7 days, where can I get t... by samlinsongguo Communicator in Splunk Enterprise Security 05-15-2018 0 3	0	3
Splunk Enterprise Security: Is there a way to write a search to identify when there is already an existing notable event? If this has already been covered, please provide a link, but I haven't seen anything. My organization uses Splunk Cl... by eliyyah Explorer in Splunk Enterprise Security 05-15-2018 0 6	0	6
traffic fails regularly Hello all I have a problem on my splunk. The monitoring console illustrates the forwarded traffic from forwarders to ... by 920087764 Engager in Splunk Enterprise Security 05-15-2018 0 10	0	10
how to use ip_intel ? I have a search that returns a set of source and dest IP addresses. Index= ..... \| table src, dest I want to che... by pfgrobler New Member in Splunk Enterprise Security 05-14-2018 0 1	0	1
Splunk Enterprise Security: What happens to host_* fields in notable events? I have a correlation search that includes the field host and is enriched with all the usual fields such as host_nt_ho... by gabriel_vasseur Contributor in Splunk Enterprise Security 05-14-2018 0 6	0	6
I have installed the IP reputation App , But not getting any data , How to get it reolved I have installed new app IP reputation , but not getting any data , Do i need to change any configurations or search ... by gkumarashanmuga Explorer in Splunk Enterprise Security 05-14-2018 0 0	0	0
Why is global permission not working in Enterprise Security app? I have built an app (it contains eventtypes and tag) and have set it permission global. Apart from ES app, all its e... by ayushi_kaushik New Member in Splunk Enterprise Security 05-14-2018 0 1	0	1
DLP endpoint logs vs. Enterprise Security Hi there, We are receiving logs from a Data Loss Prevention (DLP) system about what users access, etc and we want to... by ikulcsar Communicator in Splunk Enterprise Security 05-14-2018 0 0	0	0
File server user audit logs vs. Enterprise Security Hi there! We are receiving logs from a NetApp file server about what user access, etc. Log format very similar/same ... by ikulcsar Communicator in Splunk Enterprise Security 05-14-2018 0 0	0	0
How to take kvstore backup for security Search Head? hi All, When am trying to take kvstore backup in Security Search Head as part of upgrade process am getting below er... by mallempatisreed Explorer in Splunk Enterprise Security 05-13-2018 0 1	0	1
Notable Event Suppressions won't create We have set the appropriate role and permissions on SA-ThreatInigence (write access) to enable ess_admin users to cre... by panovattack Communicator in Splunk Enterprise Security 05-11-2018 0 0	0	0
How to reference a token name with spaces in it for notable event action? (ES Correlation Searches) I'm working on creating new notable events in Enterprise Security. In the notable event alert action, I'm trying to a... by masonmorales Influencer in Splunk Enterprise Security 05-10-2018 0 3	0	3
Can CORE Search function Like ES In our DEV space we are running a single search head with ES installed. We have built identity lookups from our HR da... by pfabrizi Path Finder in Splunk Enterprise Security 05-09-2018 0 1	0	1
Installation of Httpedgegrid on Search heads of Splunk ES Hi How to install the Httpedgegrid on Search heads of Splunk Enterprise Security. @mayurr98 by Mayanakhan Explorer in Splunk Enterprise Security 05-09-2018 0 0	0	0
AD FS integration with Splunk I’m in the process of on-boarding ADFS as a authentication and authorization log source for a number of applications ... by pbcahill New Member in Splunk Enterprise Security 05-09-2018 0 0	0	0
Best Practice: Separating Dev/Test and Prod Notables in Incident Review I'm looking to provide two separate ES incident review views: one for rules that are live, and another for new rules ... by tfrederick74656 Explorer in Splunk Enterprise Security 05-04-2018 0 0	0	0
Missing buttons on ES "Configure Navigation" page I'm trying to follow the "Customize the Menu Bar" steps in https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Custo... by tfrederick74656 Explorer in Splunk Enterprise Security 05-04-2018 0 3	0	3
Enterprise Security: Upgrading from 4.1.x to 4.7.x version on SHC I was looking into upgrade of ES from 4.1.x version to 4.7.x version. (alongside Splunk). I can see ES changed dramat... by koshyk Super Champion in Splunk Enterprise Security 05-04-2018 0 6	0	6
How to automatically generate shortIDs to link/share notables event on the ES Incident Review dashboard?,How to automatically generate shortIDs to link and share notable events on the ES Incident Review dashboard? From the Incident Review dashboard > Actions is possible to Share Notable Events. To get the URL of the notable event... by heyyyyy Explorer in Splunk Enterprise Security 05-02-2018 1 5	1	5
Splunk PCI Installation of indexes Hello, I am installing Splunk PCI app 3.5.0 on an environment that is made of a Search Head and two indexers (not clu... by cafissimo Communicator in Splunk Enterprise Security 05-02-2018 0 1	0	1