Splunk Enterprise Security

Community Activity

Splunk App for Enterprise Security: Are there any test plans and sample test cases related to security using this app? Hi All, I am new to Splunk. In my project we are using Splunk App for Enterprise security. I would like to know what... by luckymaddy Explorer in Splunk Enterprise Security 04-27-2015 0 8	0	8
How to deploy the Splunk App for Enterprise Security in an Indexer and Search Head Clustering environment? Hi, I am trying to simulate a cluster environment for the Splunk App for Enterprise Security. The setup is: -Two I... by masiddiqu Explorer in Splunk Enterprise Security 04-23-2015 0 3	0	3
After integrating a new Key Security Indicator in an Enterprise Security dashboard, how do I get the drilldown URL to point to a dashboard in my custom app? Hi, I've created a new Key Security Indicator for my app and have integrated it in the Security Posture dashboard of... by georget Explorer in Splunk Enterprise Security 04-22-2015 0 3	0	3
Can multiple instances of the Splunk App for Enterprise Security point to same indexer cluster? I have a scenario. The customer has two teams ABC, XYZ and they have their own Enterprise Security setup. each team h... by bheemireddi Communicator in Splunk Enterprise Security 04-18-2015 1 1	1	1
After a fresh installation, how do I deploy the Splunk App for Enterprise Security? I have been assigned the task of deploying the Splunk App for Enterprise Security on Linux machines. Here is my requi... by Splunk_Bw Explorer in Splunk Enterprise Security 04-16-2015 0 2	0	2
How to extract time string represented by hex (TA-sav)? The sample data which comes with the TA-sav add-on has its timestamp in a weird hexadecimal format. It looks like th... by coleman07 Path Finder in Splunk Enterprise Security 04-09-2015 0 3	0	3
can you have a domain in a threatlist url? Can you put in the url field of the threat list a domain value? For example, these were where domains were listed xx... by mcronkrite Splunk Employee in Splunk Enterprise Security 03-27-2015 0 1	0	1
Splunk for Enterprise Security: Why loading the debug/refresh endpoint causes correlation searches to stop producing notable events? Any time I load the debug/refresh endpoint, correlation searches stop running. Or, at least, they stop producing nota... by tkopchak SplunkTrust in Splunk Enterprise Security 03-26-2015 0 1	0	1
ES Data Model Acceleration - Never Finishes/Stuck at 99% I'm working on tuning our data model accelerations and the first problem I'm running into is that they never finish. ... by jonathan_cooper Communicator in Splunk Enterprise Security 03-26-2015 7 8	7	8
Splunk for Enterprise Security: Is it possible to allow non-admin users to create notable events manually? Good afternoon. This is related to Enterprise Security 3.1.1 build 219910. Is it possible to allow a non-admin user... by adsplunk1 New Member in Splunk Enterprise Security 03-18-2015 0 2	0	2
Splunk for Enterprise Security: How can I force Splunk to check for a new version of my CSV threat lists? Hi, I am using Splunk 6.2.2 and Enterprise Security 3.1.1. I have a bunch of threat lists (the actual URLs are looku... by RiccardoV Communicator in Splunk Enterprise Security 03-18-2015 1 1	1	1
Creating workflows using ES App Can I create a security operations workflows using the ES app? For example, if I want a ticket to be opened in the ti... by coolwater77 Explorer in Splunk Enterprise Security 03-15-2015 1 5	1	5
Splunk App for Enterprise Security: After disabling the Google search feature, why is it still an available option in the Incident Review dashboard? I've disabled the Google search feature in ./SA-ThreatIntelligence/local/workflow_actions.conf and confirmed it is no... by Chubbybunny Splunk Employee in Splunk Enterprise Security 03-11-2015 1 1	1	1
Splunk App for Enterprise Security 3.2.1: Why am I getting hourly script failure errors with configuration_check.py on the search head? I realize this will be simple for someone with more experience than I have. Running 2 search heads, 2 indexers, manag... by dschmidt_cfi Path Finder in Splunk Enterprise Security 03-11-2015 2 13	2	13
In threatlists can you have multiple values in url? Can you have multiple domain names on single url field? Or does every row have to have single domain name? by mcronkrite Splunk Employee in Splunk Enterprise Security 03-07-2015 0 4	0	4
Splunk App for Enterprise Security: Is there a way to clear out all previously imported Nessus data? I have been testing the Splunk Add-on for Nessus and want to start using the feature with fresh data. Is there a way... by john_miller1 Explorer in Splunk Enterprise Security 03-03-2015 0 1	0	1
Splunk ES APP Correlation Search Email Output Action Hello Everyone, I need to setup the email output action for ES APP correlation Searches , I have found that we cant ... by skathpal Explorer in Splunk Enterprise Security 02-26-2015 0 1	0	1
Splunk App for Enterprise Security: Why am I getting error "undefined symbol: __xmlStructuredErrorContext" when merging an identity? According to the documentation for ES Asset management here: http://docs.splunk.com/Documentation/ES/3.2.1/User/Asse... by mzorzi Splunk Employee in Splunk Enterprise Security 02-26-2015 1 1	1	1
Splunk Enterprise Security - TSIDX-dependent Correlation Searches not working after 3.0 upgrade We recently upgraded our Enterprise Security instance to v3.0 from v2.4. After the upgrade, I noticed that Correlatio... by BenjaminWyatt Communicator in Splunk Enterprise Security 02-25-2015 0 4	0	4
Is there way to use hash or file name matches for threatlist? by mcronkrite Splunk Employee in Splunk Enterprise Security 02-23-2015 0 1	0	1
Splunk App for Enterprise Security: If I add a new custom threatlist, will it match old events too or only new events after creating the threatlist? Hi, I have a question about custom threatlists in Splunk App for Enterprise Security. If I add a new custom threatli... by RiccardoV Communicator in Splunk Enterprise Security 02-18-2015 0 3	0	3
Which type of file can I add as threat list in Splunk Enterprise Security? Hi guys, I am wondering if I could use a binary file with my own format as threat list in Splunk ES app. That file co... by RiccardoV Communicator in Splunk Enterprise Security 02-18-2015 0 1	0	1
Splunk Enterprise Security and Notable Events Hi, I"m running the Enterprise Security app and I"m facing the following issue: Notable events or Incidents are cre... by Alteek Explorer in Splunk Enterprise Security 02-17-2015 0 2	0	2
When do I need to surround a field name with single ticks, double ticks, and when do I not need them at all in a search? I'm trying to integrate McAfee data into ES and I am having difficulties using the datamodel command. Why does this ... by chris Motivator in Splunk Enterprise Security 02-16-2015 1 2	1	2
Since Enterprise Security can only have 1 instance running, how do you handle high availability if that search head stops working? Hi all, Have a 2 site distributed-architecture of Splunk, with 1 Search-Head in either site (and indexers and heavy-... by Splunker Communicator in Splunk Enterprise Security 02-11-2015 0 2	0	2

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Enterprise Security

Splunk App for Enterprise Security: Are there any test plans and sample test cases related to security using this app?

How to deploy the Splunk App for Enterprise Security in an Indexer and Search Head Clustering environment?

After integrating a new Key Security Indicator in an Enterprise Security dashboard, how do I get the drilldown URL to point to a dashboard in my custom app?

Can multiple instances of the Splunk App for Enterprise Security point to same indexer cluster?

After a fresh installation, how do I deploy the Splunk App for Enterprise Security?

How to extract time string represented by hex (TA-sav)?

can you have a domain in a threatlist url?

Splunk for Enterprise Security: Why loading the debug/refresh endpoint causes correlation searches to stop producing notable events?

ES Data Model Acceleration - Never Finishes/Stuck at 99%

Splunk for Enterprise Security: Is it possible to allow non-admin users to create notable events manually?

Splunk for Enterprise Security: How can I force Splunk to check for a new version of my CSV threat lists?

Creating workflows using ES App

Splunk App for Enterprise Security: After disabling the Google search feature, why is it still an available option in the Incident Review dashboard?

Splunk App for Enterprise Security 3.2.1: Why am I getting hourly script failure errors with configuration_check.py on the search head?

In threatlists can you have multiple values in url?

Splunk App for Enterprise Security: Is there a way to clear out all previously imported Nessus data?

Splunk ES APP Correlation Search Email Output Action

Splunk App for Enterprise Security: Why am I getting error "undefined symbol: __xmlStructuredErrorContext" when merging an identity?

Splunk Enterprise Security - TSIDX-dependent Correlation Searches not working after 3.0 upgrade

Is there way to use hash or file name matches for threatlist?

Splunk App for Enterprise Security: If I add a new custom threatlist, will it match old events too or only new events after creating the threatlist?

Which type of file can I add as threat list in Splunk Enterprise Security?

Splunk Enterprise Security and Notable Events

When do I need to surround a field name with single ticks, double ticks, and when do I not need them at all in a search?

Since Enterprise Security can only have 1 instance running, how do you handle high availability if that search head stops working?

Splunk Observability for AI

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

Exchange Online Logs in Splunk

Disposition CHart

How to handle Defender Incidents/Alerts with ES No...

Splunk Enterprise Security API support for update ...

Clarification on UBA Capability in Splunk Enterpri...

Splunk Enterprise Security

Are you a member of the Splunk Community?