Splunk Enterprise Security

Community Activity

After integrating a new Key Security Indicator in an Enterprise Security dashboard, how do I get the drilldown URL to point to a dashboard in my custom app? Hi, I've created a new Key Security Indicator for my app and have integrated it in the Security Posture dashboard of... by georget Explorer in Splunk Enterprise Security 04-22-2015 0 3	0	3
Can multiple instances of the Splunk App for Enterprise Security point to same indexer cluster? I have a scenario. The customer has two teams ABC, XYZ and they have their own Enterprise Security setup. each team h... by bheemireddi Communicator in Splunk Enterprise Security 04-18-2015 1 1	1	1
After a fresh installation, how do I deploy the Splunk App for Enterprise Security? I have been assigned the task of deploying the Splunk App for Enterprise Security on Linux machines. Here is my requi... by Splunk_Bw Explorer in Splunk Enterprise Security 04-16-2015 0 2	0	2
How to extract time string represented by hex (TA-sav)? The sample data which comes with the TA-sav add-on has its timestamp in a weird hexadecimal format. It looks like th... by coleman07 Path Finder in Splunk Enterprise Security 04-09-2015 0 3	0	3
can you have a domain in a threatlist url? Can you put in the url field of the threat list a domain value? For example, these were where domains were listed xx... by mcronkrite Splunk Employee in Splunk Enterprise Security 03-27-2015 0 1	0	1
Splunk for Enterprise Security: Why loading the debug/refresh endpoint causes correlation searches to stop producing notable events? Any time I load the debug/refresh endpoint, correlation searches stop running. Or, at least, they stop producing nota... by tkopchak SplunkTrust in Splunk Enterprise Security 03-26-2015 0 1	0	1
ES Data Model Acceleration - Never Finishes/Stuck at 99% I'm working on tuning our data model accelerations and the first problem I'm running into is that they never finish. ... by jonathan_cooper Communicator in Splunk Enterprise Security 03-26-2015 7 8	7	8
Splunk for Enterprise Security: Is it possible to allow non-admin users to create notable events manually? Good afternoon. This is related to Enterprise Security 3.1.1 build 219910. Is it possible to allow a non-admin user... by adsplunk1 New Member in Splunk Enterprise Security 03-18-2015 0 2	0	2
Splunk for Enterprise Security: How can I force Splunk to check for a new version of my CSV threat lists? Hi, I am using Splunk 6.2.2 and Enterprise Security 3.1.1. I have a bunch of threat lists (the actual URLs are looku... by RiccardoV Communicator in Splunk Enterprise Security 03-18-2015 1 1	1	1
Creating workflows using ES App Can I create a security operations workflows using the ES app? For example, if I want a ticket to be opened in the ti... by coolwater77 Explorer in Splunk Enterprise Security 03-15-2015 1 5	1	5
Splunk App for Enterprise Security: After disabling the Google search feature, why is it still an available option in the Incident Review dashboard? I've disabled the Google search feature in ./SA-ThreatIntelligence/local/workflow_actions.conf and confirmed it is no... by Chubbybunny Splunk Employee in Splunk Enterprise Security 03-11-2015 1 1	1	1
Splunk App for Enterprise Security 3.2.1: Why am I getting hourly script failure errors with configuration_check.py on the search head? I realize this will be simple for someone with more experience than I have. Running 2 search heads, 2 indexers, manag... by dschmidt_cfi Path Finder in Splunk Enterprise Security 03-11-2015 2 13	2	13
In threatlists can you have multiple values in url? Can you have multiple domain names on single url field? Or does every row have to have single domain name? by mcronkrite Splunk Employee in Splunk Enterprise Security 03-07-2015 0 4	0	4
Splunk App for Enterprise Security: Is there a way to clear out all previously imported Nessus data? I have been testing the Splunk Add-on for Nessus and want to start using the feature with fresh data. Is there a way... by john_miller1 Explorer in Splunk Enterprise Security 03-03-2015 0 1	0	1
Splunk ES APP Correlation Search Email Output Action Hello Everyone, I need to setup the email output action for ES APP correlation Searches , I have found that we cant ... by skathpal Explorer in Splunk Enterprise Security 02-26-2015 0 1	0	1
Splunk App for Enterprise Security: Why am I getting error "undefined symbol: __xmlStructuredErrorContext" when merging an identity? According to the documentation for ES Asset management here: http://docs.splunk.com/Documentation/ES/3.2.1/User/Asse... by mzorzi Splunk Employee in Splunk Enterprise Security 02-26-2015 1 1	1	1
Splunk Enterprise Security - TSIDX-dependent Correlation Searches not working after 3.0 upgrade We recently upgraded our Enterprise Security instance to v3.0 from v2.4. After the upgrade, I noticed that Correlatio... by BenjaminWyatt Communicator in Splunk Enterprise Security 02-25-2015 0 4	0	4
Is there way to use hash or file name matches for threatlist? by mcronkrite Splunk Employee in Splunk Enterprise Security 02-23-2015 0 1	0	1
Splunk App for Enterprise Security: If I add a new custom threatlist, will it match old events too or only new events after creating the threatlist? Hi, I have a question about custom threatlists in Splunk App for Enterprise Security. If I add a new custom threatli... by RiccardoV Communicator in Splunk Enterprise Security 02-18-2015 0 3	0	3
Which type of file can I add as threat list in Splunk Enterprise Security? Hi guys, I am wondering if I could use a binary file with my own format as threat list in Splunk ES app. That file co... by RiccardoV Communicator in Splunk Enterprise Security 02-18-2015 0 1	0	1
Splunk Enterprise Security and Notable Events Hi, I"m running the Enterprise Security app and I"m facing the following issue: Notable events or Incidents are cre... by Alteek Explorer in Splunk Enterprise Security 02-17-2015 0 2	0	2
When do I need to surround a field name with single ticks, double ticks, and when do I not need them at all in a search? I'm trying to integrate McAfee data into ES and I am having difficulties using the datamodel command. Why does this ... by chris Motivator in Splunk Enterprise Security 02-16-2015 1 2	1	2
Since Enterprise Security can only have 1 instance running, how do you handle high availability if that search head stops working? Hi all, Have a 2 site distributed-architecture of Splunk, with 1 Search-Head in either site (and indexers and heavy-... by Splunker Communicator in Splunk Enterprise Security 02-11-2015 0 2	0	2
customizing fields in incident review tickets Can I customized the fields that I see for an incident ticket for the notable event in the incident review dashboard.... by coolwater77 Explorer in Splunk Enterprise Security 02-04-2015 4 9	4	9
Splunk App for Enterprise Security: Why are all dashboards and reports empty even with the Splunk Add-on for Microsoft Windows installed? I installed the Splunk App for Enterprise Security, but all dashboards and reports are empty. The Splunk_TA_windows A... by FRoth Contributor in Splunk Enterprise Security 02-02-2015 0 2	0	2

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Splunk Enterprise Security

After integrating a new Key Security Indicator in an Enterprise Security dashboard, how do I get the drilldown URL to point to a dashboard in my custom app?

Can multiple instances of the Splunk App for Enterprise Security point to same indexer cluster?

After a fresh installation, how do I deploy the Splunk App for Enterprise Security?

How to extract time string represented by hex (TA-sav)?

can you have a domain in a threatlist url?

Splunk for Enterprise Security: Why loading the debug/refresh endpoint causes correlation searches to stop producing notable events?

ES Data Model Acceleration - Never Finishes/Stuck at 99%

Splunk for Enterprise Security: Is it possible to allow non-admin users to create notable events manually?

Splunk for Enterprise Security: How can I force Splunk to check for a new version of my CSV threat lists?

Creating workflows using ES App

Splunk App for Enterprise Security: After disabling the Google search feature, why is it still an available option in the Incident Review dashboard?

Splunk App for Enterprise Security 3.2.1: Why am I getting hourly script failure errors with configuration_check.py on the search head?

In threatlists can you have multiple values in url?

Splunk App for Enterprise Security: Is there a way to clear out all previously imported Nessus data?

Splunk ES APP Correlation Search Email Output Action

Splunk App for Enterprise Security: Why am I getting error "undefined symbol: __xmlStructuredErrorContext" when merging an identity?

Splunk Enterprise Security - TSIDX-dependent Correlation Searches not working after 3.0 upgrade

Is there way to use hash or file name matches for threatlist?

Splunk App for Enterprise Security: If I add a new custom threatlist, will it match old events too or only new events after creating the threatlist?

Which type of file can I add as threat list in Splunk Enterprise Security?

Splunk Enterprise Security and Notable Events

When do I need to surround a field name with single ticks, double ticks, and when do I not need them at all in a search?

Since Enterprise Security can only have 1 instance running, how do you handle high availability if that search head stops working?

customizing fields in incident review tickets

Splunk App for Enterprise Security: Why are all dashboards and reports empty even with the Splunk Add-on for Microsoft Windows installed?

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Is there any documentation about this App?

ES 8.3.0 / 8.4 — investigations silently missing f...

Unable to edit notable comments in incident review

CIM normalization on ES Splunk Cloud Classic - Use...

Notable

Splunk Enterprise Security

Join the Conversation