Splunk Enterprise Security

Discussions

Thread Info

Does someone have an example that shows how to ignore 2 or 3 domains for a Splunk Enterprise Security threat list?

So the threat lists that come with Splunk Enterprise Security are great, but sometimes we need to ignore a single dom...

by Explorer in

Why is my Splunk Enterprise Security 4.0.0 installation failing?

I'm unable to install the Splunk Enterprise Security app (version 4.0.0). I'm trying to install using file (from U...

by Engager in

Splunk Enterprise Security doesn’t recognize eventtypes from custom TA

I’ve created a custom TA in order to make it work with Enterprise Security and packaged it with 'TA_foo' deploying it...

by Splunk Employee in

Splunk Enterprise Security: Why am I getting "[indexer] The search for datamodel 'Threat_Intelligence' failed to parse, cannot get indexes to search"?

Hello, I have an error message in the threat activity dashboard in a Splunk Entreprise Security search head: [i...

by Communicator in

Why do correlation searches in Enterprise Security not use "summariesOnly=true"?

hi, I was looking into the out-of-box Splunk correlation searches in Splunk Enterprise Security (ES) and it contai...

by Super Champion in

Does Splunk Enterprise Security support version 2008-R2 / 2012 of Active Directory (or LDAP) for authentication?

Does anyone know if Splunk Enterprise Security supports Active Directory (or LDAP) for authentication, version 2008-R...

by New Member in

McAfee security management center syslog format ?

hello , We want to add our Mcafee Firwall logs into splunk (ES) using syslog. which format is used by Splunk Add-on...

by New Member in

Splunk Enterprise Security: How can I do a cidrmatch against a data model field?

I'm working with Splunk Enterprise Security and I'm trying to build/refine correlations against the Network Traffic D...

by Explorer in

Configuring the Receiving of data from Riverbed WAN optimizer CX 3070 into Splunk

Hello Dev Team, We are trying to receive logs from Riverbed CX-3070 Wan optimizer device into Splunk. In the ...

by Communicator in

Splunk Add-on for Cisco ASA: Will dropping "Built" events have any impact on Splunk Enterprise Security dashboards?

Hi All, Just getting the community consensus here. Cisco ASA log events for Built and Teardown essentially contain...

by Builder in

Splunk Enterprise Security: How to update the Incident Review Audit Dashboard to include a timepicker?

Has anyone ever tried updating the Incident Review Audit Dashboard in Splunk ES to include a timepicker? I can't s...

by Communicator in

Splunk Enterprise Security: Threat Intelligence Audit dashboard is not displaying properly due to strptime() conversion in dashboard search

In Enterprise Security, the Threat Intelligence Audit dashboard is not displaying properly. The _time and run_duratio...

by Splunk Employee in

How to generate a lookup to dynamically add Active Directory to the Splunk Enterprise Security - Assets and Identity list?

Can any one help me in generating a lookup to dynamically add the Active Directory to the Splunk Enterprise Security ...

by Explorer in

Working with the Splunk Enterprise Security demo, is there a way to reset/delete all the demo data?

I'm working with the Splunk Enterprise Security demo. Is there a way to reset it / delete all the data that it starts...

by Explorer in

How to make sense of data

So we have various types of logs that Splunk collects. E.g. Windows events, web server logs, syslogs, cisco switches ...

by Path Finder in

After upgrading Splunk Enterprise Security from 3.0.1 to 4.0.1, why does the "Notable Events by Urgency" dashboard display "No results found"?

Hi all, Just upgraded Enterprise Security 3.0.1 to 4.0.1, all went well with the exception of one outstanding item...

by Explorer in

After installing Splunk Enterprise Security on a search head, why are all connected indexers showing 100% CPU utilization?

I have one search head and 3 indexers consuming about 50gb of data a day. All servers are running Splunk 6.3.1. The i...

by Explorer in

Splunk Enterprise Security: Adding objects to data model caused dashboards to show invalid data. Is there a way to return the data model to its "original" setup?

I added several objects to the "Vulnerabilities" data model. After that the Enterprise Security /Security Domains/Net...

by New Member in

Splunk Enterprise Security: Is there a way to accept JSON as a threat intelligence download?

Is there a way to accept a JSON as a threat intelligence download? I have a threat intelligence vendor that only prov...

by Communicator in

Splunk Enterprise Security: How to drop all events on Exchange servers except for remote OWA access?

We run a few Exchange servers and we need to collect logs for our Splunk Enterprise Security Suite, however, there ar...

by Path Finder in

Get Updates on the Splunk Community!

Splunk Enterprise Security

Discussions

Does someone have an example that shows how to ignore 2 or 3 domains for a Splunk Enterprise Security threat list?

Why is my Splunk Enterprise Security 4.0.0 installation failing?

Splunk Enterprise Security doesn’t recognize eventtypes from custom TA

Splunk Enterprise Security: Why am I getting "[indexer] The search for datamodel 'Threat_Intelligence' failed to parse, cannot get indexes to search"?

Why do correlation searches in Enterprise Security not use "summariesOnly=true"?

Does Splunk Enterprise Security support version 2008-R2 / 2012 of Active Directory (or LDAP) for authentication?

McAfee security management center syslog format ?

Splunk Enterprise Security: How can I do a cidrmatch against a data model field?

Configuring the Receiving of data from Riverbed WAN optimizer CX 3070 into Splunk

Splunk Add-on for Cisco ASA: Will dropping "Built" events have any impact on Splunk Enterprise Security dashboards?

Splunk Enterprise Security: How to update the Incident Review Audit Dashboard to include a timepicker?

Splunk Enterprise Security: Threat Intelligence Audit dashboard is not displaying properly due to strptime() conversion in dashboard search

How to generate a lookup to dynamically add Active Directory to the Splunk Enterprise Security - Assets and Identity list?

Working with the Splunk Enterprise Security demo, is there a way to reset/delete all the demo data?

How to make sense of data

After upgrading Splunk Enterprise Security from 3.0.1 to 4.0.1, why does the "Notable Events by Urgency" dashboard display "No results found"?

After installing Splunk Enterprise Security on a search head, why are all connected indexers showing 100% CPU utilization?

Splunk Enterprise Security: Adding objects to data model caused dashboards to show invalid data. Is there a way to return the data model to its "original" setup?

Splunk Enterprise Security: Is there a way to accept JSON as a threat intelligence download?

Splunk Enterprise Security: How to drop all events on Exchange servers except for remote OWA access?

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Introducing Edge Processor: Next Gen Data Transformation

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

How can I make an ES Incident Review copy of my No...

How to duplicate Notables in ES Incident Review?

How to add new field for filtering in Splunk ES in...

Enterprise Security - Correlation Search - Notable...

Enterprise Security Incident Review Default Filter...