Splunk Enterprise Security

Community Activity

Upgrade Enterprise Security from 3.3.x to 4.0 hangs on "Disabling Apps" I am doing an upgrade of Enterprise Security from 3.3.1 to 4.0 through the GUI. I installed the app by providing it t... by fairje Communicator in Splunk Enterprise Security 06-23-2016 0 10	0	10
Is it possible to pass values from a notable event to a shell script? Hello In Enterprise Security, there is the option to run a script as a follow on action to a notable event. Is it po... by gary_richardson Path Finder in Splunk Enterprise Security 06-20-2016 0 3	0	3
Is there some sort of list of which CIM area common sourcetypes fit in? Hello everyone, There is extensive documentation on what fields need to exist in order for a data source to fit into... by j4adam Communicator in Splunk Enterprise Security 06-13-2016 1 2	1	2
What is the best way to change sourcetype for Linux Audit Events coming from OSSEC? Hi, We have Linux Audit log data coming in Via OSSEC into Splunk. For this data, source is set to /var/ossec/logs/al... by att35 Builder in Splunk Enterprise Security 06-08-2016 0 11	0	11
My search parses all fields in the Search App, but why do I get null results putting it in a Splunk Enterprise Security correlation search? Hi all, I wrote this search that shows me when certain SSIDs are matched. sourcetype=rogap SSID="skynet" OR SSID... by splunk_cv Explorer in Splunk Enterprise Security 06-03-2016 0 5	0	5
Splunk App for Enterprise Security: How to troubleshoot if the Threat Intelligence Source data is actually being downloaded? After configuring the proxy settings for downloading the Splunk for Enterprise Security Intelligence Source data, I a... by trross33 Path Finder in Splunk Enterprise Security 06-03-2016 0 1	0	1
How to test a correlation search? So this is the pre-configured correlation search called "substantial increase in port activity". I'd like to tweak i... by echojacques Builder in Splunk Enterprise Security 06-02-2016 0 5	0	5
Why ES threat list lookup fails on pivot data, but works with direct search on indexed data? Is there anything different when running a lookup on data returned by a pivot compared to the same lookup running on ... by dragoslungu Explorer in Splunk Enterprise Security 05-25-2016 4 1	4	1
Splunk Enterprise Security: Is it better to have more or less indexes when handling a lot of distinct types of data? Hi, Splunkers We have a single instance as an Indexer, Search head, and Splunk Enterprise Security (32Gb RAM,16 vCPU... by evelenke Contributor in Splunk Enterprise Security 05-24-2016 1 4	1	4
How to troubleshoot error "A script exited abnormally...deploy_splunk_ta_netscaler.py"? I get this error every hour at my installation: msg="A script exited abnormally" input="./bin/scripted_inputs/deplo... by andresito123 Communicator in Splunk Enterprise Security 05-24-2016 0 2	0	2
Tuning Risk Scores and resetting score values Hi, I'm in the process of tuning our risk scores, as applied to objects (users or assets) from a correlation search.... by sheamus69 Communicator in Splunk Enterprise Security 05-20-2016 0 3	0	3
Upgrading Splunk Enterprise Security fails on enabling / disabling add-ons - Solution Hi All, I am just posting a solution to an issue I have had with two upgrades for Splunk Enterprise Security. First... by domenico_perre Path Finder in Splunk Enterprise Security 05-12-2016 0 1	0	1
Learning SIEM basics Hello, I now have fairly good experience with Splunk and want to learn more about SIEM but not sure where to start. ... by hemendralodhi Contributor in Splunk Enterprise Security 05-09-2016 0 2	0	2
Splunk Enterprise Security: What is the best way to add details to asset information? Hello Splunkers, Can someone provide some guidance on what is the best or recommended method of adding context to as... by splunker1981 Path Finder in Splunk Enterprise Security 05-08-2016 0 2	0	2
How to use earliest and latest in my inputlookup search to filter results? Hello Splunk Answers! I'm relatively new to Splunk - pardon if this is a very basic question. I've looked through pr... by tsidie Engager in Splunk Enterprise Security 05-04-2016 0 2	0	2
Why does Enterprise Security 3.0 not see the tags or field aliases properly in Splunk 6.0 or 6.1? I have Splunk Enterprise 6.1, I've had the same issue on 6.0, and Enterprise Security 3.0 running. I pull in a dataso... by chrishatfield21 Path Finder in Splunk Enterprise Security 04-29-2016 0 1	0	1
Are Splunk Enterprise Security and Splunk User Behavior Analytics (Splunk UBA) totally independent apps? Hi, Is Splunk Enterprise Security and Splunk User Behavior Analytics (Splunk UBA) totally independent apps? Do they... by otan1010 Explorer in Splunk Enterprise Security 04-25-2016 1 1	1	1
Splunk Enterprise Security 4.x app questions We've provided some background info to go with the questions as they relate to the Splunk Enterprise Security 4.x app... by joshfu New Member in Splunk Enterprise Security 04-22-2016 0 3	0	3
Does anyone have test data that can fire off various correlation searches for notable events in Splunk Enterprise Security? Hi, Does anyone in the community have test data that can fire off various Correlation Searches for Notable Events in... by mvrider Engager in Splunk Enterprise Security 04-21-2016 1 1	1	1
Splunk Enterprise Security: Some dashboards are populated with data, but why not the Threat Activity dashboard? The treat activity dashboard won't populate in the Splunk Enterprise Security app, although other dashboards (not all... by Fraankiiie Engager in Splunk Enterprise Security 04-21-2016 0 7	0	7
ES Security App: Multi-line header is missing matching quotation, or could not parse CSV header I have recurring warnings in splunkd logs with multi-line header is missing matching quotation, or could not parse C... by neelamsantosh Path Finder in Splunk Enterprise Security 04-19-2016 0 4	0	4
Should the Splunk App for ES Health Check be installed prior to installing Splunk Enterprise Security? Should the Splunk App for ES Health Check be installed prior to Splunk Enterprise Security being installed? Can it ... by ryanoconnor Builder in Splunk Enterprise Security 04-15-2016 0 1	0	1
Splunk Enterprise Security 4.0.1: How to import TAXII Observables defined Using Cybox Regex Syntax? I'm running Splunk Enterprise Security 4.0.1, and trying to import and match against Observables defined using Cybox ... by johnmccash Explorer in Splunk Enterprise Security 04-15-2016 1 5	1	5
How do I export Enterprise Security (ES) investigations as a PDF or report? I'm doing research inside of Splunk Enterprise Security, and I'm tagging events into the timeline. I've gone into the... by ccrider New Member in Splunk Enterprise Security 04-14-2016 0 2	0	2
Splunk Enterprise Security: Is it possible to automate assignment of notable events to groups? Is it possible to automate assignment of notable events to groups? For example, if a new notable event is triggered,... by rahul130191 New Member in Splunk Enterprise Security 04-14-2016 0 1	0	1

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Self-Healing Pipeline Is Now Generally Available: AI-Powered CIM Compliance

Maintaining data integrity across security and analytics pipelines is an ongoing challenge. Data ...

Splunk Enterprise Security

Upgrade Enterprise Security from 3.3.x to 4.0 hangs on "Disabling Apps"

Is it possible to pass values from a notable event to a shell script?

Is there some sort of list of which CIM area common sourcetypes fit in?

What is the best way to change sourcetype for Linux Audit Events coming from OSSEC?

My search parses all fields in the Search App, but why do I get null results putting it in a Splunk Enterprise Security correlation search?

Splunk App for Enterprise Security: How to troubleshoot if the Threat Intelligence Source data is actually being downloaded?

How to test a correlation search?

Why ES threat list lookup fails on pivot data, but works with direct search on indexed data?

Splunk Enterprise Security: Is it better to have more or less indexes when handling a lot of distinct types of data?

How to troubleshoot error "A script exited abnormally...deploy_splunk_ta_netscaler.py"?

Tuning Risk Scores and resetting score values

Upgrading Splunk Enterprise Security fails on enabling / disabling add-ons - Solution

Learning SIEM basics

Splunk Enterprise Security: What is the best way to add details to asset information?

How to use earliest and latest in my inputlookup search to filter results?

Why does Enterprise Security 3.0 not see the tags or field aliases properly in Splunk 6.0 or 6.1?

Are Splunk Enterprise Security and Splunk User Behavior Analytics (Splunk UBA) totally independent apps?

Splunk Enterprise Security 4.x app questions

Does anyone have test data that can fire off various correlation searches for notable events in Splunk Enterprise Security?

Splunk Enterprise Security: Some dashboards are populated with data, but why not the Threat Activity dashboard?

ES Security App: Multi-line header is missing matching quotation, or could not parse CSV header

Should the Splunk App for ES Health Check be installed prior to installing Splunk Enterprise Security?

Splunk Enterprise Security 4.0.1: How to import TAXII Observables defined Using Cybox Regex Syntax?

How do I export Enterprise Security (ES) investigations as a PDF or report?

Splunk Enterprise Security: Is it possible to automate assignment of notable events to groups?

Announcing Modern Navigation: A New Era of Splunk User Experience

Preparing your Splunk Environment for OpenSSL3

Self-Healing Pipeline Is Now Generally Available: AI-Powered CIM Compliance

Notable

Hide findings not suppressing findings that are pa...

Event-Based Detection findings appear both inside ...

Enterprise Security - Entity zones

ES 8.5.1 - Comments not appearing in incident_revi...

Splunk Enterprise Security

Join the Conversation