Splunk Enterprise Security

Community Activity

	May I have a help to configure wildcard usage in lookup table? Hello, I’d like to configure a wildcard usage for a lookup table, but unfortunately I’m not a Splunk guru and probab... by AlexeySh Communicator in Splunk Enterprise Security 06-08-2018 0 2	0	2
	Splunk CIM mismatch type for tags Not sure how to fix this, but for some reason the tags showing up in Search > Datasets > Intrusion Detection > IDS A... by DEAD_BEEF Builder in Splunk Enterprise Security 06-06-2018 0 0	0	0
	Why Splunk CIM does not apply tags but 'Search & Reporting' does? Within Splunk ES, I have two tags applied based on Event types and cannot for the life of me get it to apply when att... by DEAD_BEEF Builder in Splunk Enterprise Security 06-06-2018 0 1	0	1
	Why aren't my IDS logs populating the Intrusion Detection data model? I am using Splunk ES and trying to match my IDS logs to the Intrusion Detection data model. I thought I did all prep... by DEAD_BEEF Builder in Splunk Enterprise Security 06-06-2018 0 1	0	1
	Is it possible to use a comparison / conditional functions with a lookup? Hello, I’d like to create an alert on ransomware detections. I have file events logs and their most important field ... by AlexeySh Communicator in Splunk Enterprise Security 06-06-2018 0 4	0	4
	After collecting all the logs and writing search quarries, How to do incident management and develop use-cases, and security playbooks. After collecting all the logs and writing search quarries, How to do incident management and develop use-cases, and s... by V4M51 Engager in Splunk Enterprise Security 06-05-2018 0 1	0	1
	Submit and Extract xml data Hi, I submitted a xml string to specific index using (.submit()) in python. index = splunk_client.indexes[index_nam... by avivz New Member in Splunk Enterprise Security 06-05-2018 0 0	0	0
	Can anyone recommend a relevant public malware domain list? Hello, I find that the default malware domain list used by Splunk ES (that of malwaredomains.com) is not very releva... by AlexeySh Communicator in Splunk Enterprise Security 06-05-2018 0 2	0	2
	Event ID 4738 - How to alert when source user and target user are the same ? Greetings all, I am currently using a simple Splunk query to return all changes to a user account. sourcetype=Win... by fzuazo Path Finder in Splunk Enterprise Security 05-31-2018 0 4	0	4
	Which Data Model are need to update if I use Zscaler add-on Hello All, I used the Splunk Add-on for Zscaler (https://splunkbase.splunk.com/app/3865/). But what are the data-mod... by princemanto2580 Path Finder in Splunk Enterprise Security 05-30-2018 0 1	0	1
	what is recommended sourcetype for Oracle OIM/OAM servers logs - server are running on windows server what is recommended sourcetype for Oracle OIM/OAM servers logs - server are running on windows server Logs are colle... by ab81428 Path Finder in Splunk Enterprise Security 05-30-2018 0 0	0	0
	how much is enterprise security 4.7? please provide pricing for Enterprise Security App. by janettemendoza New Member in Splunk Enterprise Security 05-29-2018 0 2	0	2
	Duplicate logs cause incorrect data in dashboard Hi, I use various dashboards which include in Splunk Enterprise Security app. In case of duplicate logs in my enviro... by shayhibah Path Finder in Splunk Enterprise Security 05-29-2018 0 3	0	3
	Detect CSRF attack on access log of Application Server Please can anyone help in suggest search SPL command line to issue on an URL field in order to detect a CSRF attack ... by brober27 New Member in Splunk Enterprise Security 05-27-2018 0 0	0	0
	How do I use Splunk ES's default lookups? All, Mind is drawing a blank. I want to normalize netstat output and then do a lookup on the destination fields to ... by daniel333 Builder in Splunk Enterprise Security 05-25-2018 0 1	0	1
	tstats errors with Splunk 7.1 + Enterprise Security 5.1? Hi. We've just upgraded to Splunk 7.1 on our ES search head, as well as upgrading ES from 5.0 to 5.1 to meet the comp... by jhigginsmq Path Finder in Splunk Enterprise Security 05-25-2018 0 2	0	2
	Splunk ES Integration with Manage Engine Service Desk Plus How can we Integrate them so that both (Manage Engine and Splunk ES Incident review) works in sync by saurabh_tek11 Communicator in Splunk Enterprise Security 05-25-2018 0 3	0	3
	Splunk ES correlation searches problem Hello, I have figured out a strange behavior of Splunk correlation searches. I'm using Splunk Enterprise version 7.0... by BAPA157 Engager in Splunk Enterprise Security 05-25-2018 0 0	0	0
	Why does the alert action I created with Add-on builder fire in Test, but not as an alert action for a Correlation Search? I created an alert action using the latest verison of Add-on Builder (v2.2) using some other Splunk answers posts as ... by shartwell Explorer in Splunk Enterprise Security 05-24-2018 0 0	0	0
	Post Processing Search as default I have multiple logs with the same unique field. for instance: Time: 10:00:00 Log-id: 0x1212 Message: ABCD Time: 10:... by shayhibah Path Finder in Splunk Enterprise Security 05-24-2018 0 4	0	4
	Vulnerbaility data model information is mismatch with datamodel acceleration Hi, using this query \| from datamodel:"Vulnerabilities"."Vulnerabilities" \|stats count by signature getting result 2... by raghu_yara New Member in Splunk Enterprise Security 05-24-2018 0 1	0	1
	Splunk Enterprise Security: Why are notable events not created and notable alert_action is not triggered? One of my Splunk Enterprise Security customer's complained that sometimes the notable events are not created even whe... by kwchang_splunk Splunk Employee in Splunk Enterprise Security 05-21-2018 0 4	0	4
	Excessive Failed Logins Correlation Search Hi guys, Im not sure how to go about this. We currently have the Excessive Failed Logins Correlation Search enabled... by bbraun New Member in Splunk Enterprise Security 05-21-2018 0 0	0	0
	Review account activity for accounts which have been flagged. Let me first say, I'm sure I could write a search that essentially returns what I'm looking for, however due to the a... by adamsmith47 Communicator in Splunk Enterprise Security 05-18-2018 0 1	0	1
	forwarding from index_a to index_b If events are coming in from heavy forwarder 1 to heavy forwarder 2, is is possible to change the index name on HF B ... by shahchintant Engager in Splunk Enterprise Security 05-18-2018 0 5	0	5