Splunk Enterprise Security

Community Activity

How to get a Full Encoded Command from a Notable We are receiving some notables that reference an encoded command being used with PowerShell, and the notable lists th... by CSNinja New Member in Splunk Enterprise Security 05-25-2024 0 2	0	2
Help creating a table that shows Incident Review Mean Time to Triage for each type of notable per notable owner Hello, This is my first time seeking help in a forum, I apologize if my ask is confusing. I'm looking to pull the... by LionWolf Explorer in Splunk Enterprise Security 05-13-2024 0 4	0	4
SOC Analyst's work with Splunk ES Hello, Splunkers!I hope there are some SOC analysts around who are using Splunk Enterprise and Splunk ES in their wor... by splunky_diamond Path Finder in Splunk Enterprise Security 05-05-2024 0 3	0	3
Read Only Executive Summary Splunk ES Is there a way to give a user read-only access to only a specific dashboard on Splunk ES such as the Executive Summar... by treven Explorer in Splunk Enterprise Security 05-03-2024 0 3	0	3
Splunk App for Enterprise Security: How to edit the Threat Intelligience Data Model to include a field within the sourcetype? So within the Enterprise Security App, there is the built-in threat activity dashboard. One of panels shows your sour... by santorof Communicator in Splunk Enterprise Security 05-01-2024 2 5	2	5
Splunk Enterprise Security Correlation Searches resources consumption Hello Splunk community! I have started my journey with splunk one month ago and I am currently learning Splunk Enterp... by splunky_diamond Path Finder in Splunk Enterprise Security 04-28-2024 0 3	0	3
Splunk Enterprise Security -> Incident Review -> What capability is required to "Edit Selected" In the Incident Review panel, we select a Notable Event, click on Edit Selected and a form pops up. I chose the first... by pkeller Contributor in Splunk Enterprise Security 04-23-2024 0 3	0	3
Difference between ES Permissions page and Splunk native edit role page Hello,does editing ES roles on Permissions page is same as editing ES roles in Splunk's native edit role page?I guess... by splunkreal Influencer in Splunk Enterprise Security 04-10-2024 0 3	0	3
Integrate SIEM in Splunk soar App started successfully (id: 1712665900147) on asset:Loaded action execution configurationexecuting action: test_as... by shubi New Member in Splunk Enterprise Security 04-09-2024 0 1	0	1
Use Case Do we have any content to detect "Moniker Link" - CVE-2024-21413 by mrkrabhishek New Member in Splunk Enterprise Security 04-07-2024 0 1	0	1
I'd like to format the Notable Event Description with spaces, bolding, and italics I've tried using html codes like <p> or <b>test</b> and it makes no difference. I'd like to format a much more compl... by mjones414 Contributor in Splunk Enterprise Security 04-07-2024 0 1	0	1
Incomplete search reults error I am getting this error,may have returned partial results try running your search again.if you see this error repeate... by sahityasweety Explorer in Splunk Enterprise Security 04-02-2024 0 4	0	4
Data Model Acceleration Issue in ES Instance Hello Splunkers,I'm encountering an issue with data model acceleration in my ES instance . A few weeks ago, I enabled... by aydinmo Explorer in Splunk Enterprise Security 04-01-2024 0 2	0	2
Input Lookup: Compare previous version of input lookup to current version using SPL Is there currently a capability in Splunk that will allow us search and compare the previous version of an input look... by regarza Engager in Splunk Enterprise Security 03-30-2024 0 3	0	3
Is it possible to make it mandatory to assign Dispositions to Notable Events in ES? Hi,Notable events in ES can now be assigned Dispositions. I am able to create new Dispositions from the Incident Revi... by ezmo1982 Path Finder in Splunk Enterprise Security 03-29-2024 1 6	1	6
Help with with saving selected fields per user. I am looking for help with Splunk configurations that the documentation does not seem to provide and can not be found... by dood9999 Explorer in Splunk Enterprise Security 03-27-2024 0 2	0	2
Is there a way to run a search with an adaptive response? I am currently in the process of creating an adaptive response that I want to be able to add some user input into a l... by justinw Explorer in Splunk Enterprise Security 03-27-2024 0 1	0	1
Splunk ES 3.0 Asset Support for ipv6 Does Splunk ES Support IPV6? I've seen some posts that others have had issues with ipv6 assets within the asset looku... by aelliott Motivator in Splunk Enterprise Security 03-08-2024 1 3	1	3
How can we track when Correlation searches were created HelloWe have multiple people working on the content in Splunk Enterprise Security, and I need to be able to find when... by LIP Loves-to-Learn in Splunk Enterprise Security 03-06-2024 0 10	0	10
Where does the incident review saved filters get saved to? I want to create a default search filter for ALL users that go into ES Incident Review. You can create a new filter ... by cmeisch Path Finder in Splunk Enterprise Security 03-04-2024 0 6	0	6
Please help me in tuning this search.. Hi,Could anyone please help me in fine tuning this search as it is raising lot of alerts\| tstats count min(_time) as ... by smith_ Builder in Splunk Enterprise Security 02-27-2024 0 5	0	5
How to Spot the Signs of Lateral Movement Hi,Could anyone pls guide me how we can detect an attacker moving laterally in the environment can be a challenge rig... by smith_ Builder in Splunk Enterprise Security 02-21-2024 0 2	0	2
Service-Now search queries to populate Splunk Enterprise Security lookup tables I'm using the Service-Now application to build some lookup tables for user and asset information, which is needed for... by milesbrennan Path Finder in Splunk Enterprise Security 02-21-2024 1 3	1	3
How do I get my Incident Review in ES to auto refresh? How do I get my Incident Review in ES to auto refresh, without having to manually auto refresh it from the browser. by mr_t2083 Explorer in Splunk Enterprise Security 02-15-2024 1 8	1	8
NFR License Hello, How do I obtain an NFR license (or the like)? We have integrations with Splunk but no way to test/evaluate th... by DRWhite1 New Member in Splunk Enterprise Security 02-13-2024 0 2	0	2