Splunk Enterprise Security

Community Activity

Splunk Enterprise Security: What happens to host_* fields in notable events? I have a correlation search that includes the field host and is enriched with all the usual fields such as host_nt_ho... by gabriel_vasseur Contributor in Splunk Enterprise Security 05-14-2018 0 6	0	6
I have installed the IP reputation App , But not getting any data , How to get it reolved I have installed new app IP reputation , but not getting any data , Do i need to change any configurations or search ... by gkumarashanmuga Explorer in Splunk Enterprise Security 05-14-2018 0 0	0	0
Why is global permission not working in Enterprise Security app? I have built an app (it contains eventtypes and tag) and have set it permission global. Apart from ES app, all its e... by ayushi_kaushik New Member in Splunk Enterprise Security 05-14-2018 0 1	0	1
DLP endpoint logs vs. Enterprise Security Hi there, We are receiving logs from a Data Loss Prevention (DLP) system about what users access, etc and we want to... by ikulcsar Communicator in Splunk Enterprise Security 05-14-2018 0 0	0	0
File server user audit logs vs. Enterprise Security Hi there! We are receiving logs from a NetApp file server about what user access, etc. Log format very similar/same ... by ikulcsar Communicator in Splunk Enterprise Security 05-14-2018 0 0	0	0
How to take kvstore backup for security Search Head? hi All, When am trying to take kvstore backup in Security Search Head as part of upgrade process am getting below er... by mallempatisreed Explorer in Splunk Enterprise Security 05-13-2018 0 1	0	1
Notable Event Suppressions won't create We have set the appropriate role and permissions on SA-ThreatInigence (write access) to enable ess_admin users to cre... by panovattack Communicator in Splunk Enterprise Security 05-11-2018 0 0	0	0
How to reference a token name with spaces in it for notable event action? (ES Correlation Searches) I'm working on creating new notable events in Enterprise Security. In the notable event alert action, I'm trying to a... by masonmorales Influencer in Splunk Enterprise Security 05-10-2018 0 3	0	3
Can CORE Search function Like ES In our DEV space we are running a single search head with ES installed. We have built identity lookups from our HR da... by pfabrizi Path Finder in Splunk Enterprise Security 05-09-2018 0 1	0	1
Installation of Httpedgegrid on Search heads of Splunk ES Hi How to install the Httpedgegrid on Search heads of Splunk Enterprise Security. @mayurr98 by Mayanakhan Explorer in Splunk Enterprise Security 05-09-2018 0 0	0	0
AD FS integration with Splunk I’m in the process of on-boarding ADFS as a authentication and authorization log source for a number of applications ... by pbcahill New Member in Splunk Enterprise Security 05-09-2018 0 0	0	0
Best Practice: Separating Dev/Test and Prod Notables in Incident Review I'm looking to provide two separate ES incident review views: one for rules that are live, and another for new rules ... by tfrederick74656 Explorer in Splunk Enterprise Security 05-04-2018 0 0	0	0
Missing buttons on ES "Configure Navigation" page I'm trying to follow the "Customize the Menu Bar" steps in https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Custo... by tfrederick74656 Explorer in Splunk Enterprise Security 05-04-2018 0 3	0	3
Enterprise Security: Upgrading from 4.1.x to 4.7.x version on SHC I was looking into upgrade of ES from 4.1.x version to 4.7.x version. (alongside Splunk). I can see ES changed dramat... by koshyk Super Champion in Splunk Enterprise Security 05-04-2018 0 6	0	6
How to automatically generate shortIDs to link/share notables event on the ES Incident Review dashboard?,How to automatically generate shortIDs to link and share notable events on the ES Incident Review dashboard? From the Incident Review dashboard > Actions is possible to Share Notable Events. To get the URL of the notable event... by heyyyyy Explorer in Splunk Enterprise Security 05-02-2018 1 5	1	5
Splunk PCI Installation of indexes Hello, I am installing Splunk PCI app 3.5.0 on an environment that is made of a Search Head and two indexers (not clu... by cafissimo Communicator in Splunk Enterprise Security 05-02-2018 0 1	0	1
How to add a custom lookup in Enterprise Security? I have seen documents for this. As per document path should be below. Select Configure > Content Management. Click C... by N92 Path Finder in Splunk Enterprise Security 05-01-2018 0 2	0	2
Send ES notable events to third party API Hello, I am trying to send notable events to third party API. Can I use webhook to POST notable event details on thi... by nitishk1 New Member in Splunk Enterprise Security 05-01-2018 0 2	0	2
Splunk App for Enterprise Security: How to add additional fields to events under "Incident Review"? Hi, We have a requirement to add some additional fields to events under "Incident Review" for IOCs (I have looked at... by MHibbin Influencer in Splunk Enterprise Security 04-30-2018 1 9	1	9
Is there a way to add searchable splunk Notable Event metadata ? All, I though it would be nice for PCI guy to search the top right by PCI DSS req, say like "10.1" its working for ... by daniel333 Builder in Splunk Enterprise Security 04-26-2018 1 1	1	1
Splunk enterprise security user acceptance test, test use cases We deploying Splunk enterprise security ( SIEM) solution) and it is in the final implementation stage. does anyone ha... by kiranhar Explorer in Splunk Enterprise Security 04-26-2018 0 1	0	1
difference between firewall log management and Splunk Security Log management as a SIEM difference between firewall log management and Splunk Security Log management as a SIEM by V4M51 Engager in Splunk Enterprise Security 04-25-2018 0 6	0	6
Why am I unable to match the 1st Dropdown List going to 2nd DropDown list using XML coding? Hi I would like to ask for help regarding how to match the first dropdown list to the 2nd dropdown list. Here the ... by atulod1 New Member in Splunk Enterprise Security 04-25-2018 0 0	0	0
Integration: Splunk Enterprise Security (ES) to Anomali Limo? Has anyone had luck defining Anomali Limo as a TAXII feed in Splunk Enterprise Security (ES)? Our internal STAXX app... by dhodzic New Member in Splunk Enterprise Security 04-24-2018 0 0	0	0
Add comment field in incident review page. Can I add comment field as table attribute in incident review page. For that what would be field name so I can map it... by N92 Path Finder in Splunk Enterprise Security 04-24-2018 0 3	0	3