Splunk Enterprise Security

Community Activity

How to search Notable Events By Owner and Severity older than 48 hours? As I understand es_notable_events is KVStore and it stores notable event information for last 48 hours/ also there is... by deodeshm Explorer in Splunk Enterprise Security 06-09-2022 0 1	0	1
How to convert Active DIrectory AccountExpires field into a date code The AccountExpires field in an AD log is described as: The date when the account expires. This value represents the... by sheamus69 Communicator in Splunk Enterprise Security 06-07-2022 0 2	0	2
Splunk ES and CIM compatibility for upgrade? Hello, We would like to use the latest CIM version (4.13.0) in order to use the Endpoint datamodel which is not avail... by spectrum2035 Explorer in Splunk Enterprise Security 05-31-2022 0 3	0	3
Help filtering out threat activity false positive I have a threat activity rule that looks at both internal IPs attempting communication externally to malicious IPs ba... by oylkm Explorer in Splunk Enterprise Security 05-30-2022 0 2	0	2
Need help please. Threat list for MITRE ATT&CK from the following link not working. Thanks a million The error says "Threat list download from https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterp... by SamHTexas Builder in Splunk Enterprise Security 05-25-2022 0 3	0	3
Seeing (SSL/TLS Compression Algorithm Information Leakage Vulnerability port 8089/tcp over SSL) from qualys scanning We are seeing this vulnerability show up via qualys vuln scanning on both our dev and production splunk instances. I ... by ncsasecops Engager in Splunk Enterprise Security 05-25-2022 2 2	2	2
How to fix slowness in Splunk ES Hi, Closing high number of incident was always done but the slowness is a new thing. Now we are facing the slowne... by Abdullah Explorer in Splunk Enterprise Security 05-25-2022 0 1	0	1
How to move multivalue fields as separate columns? Hi, I have the following case which I can't get around. My search returns something like this: In order to help secu... by fedejko Explorer in Splunk Enterprise Security 05-24-2022 0 5	0	5
Problem in using Cortex as Response Action in Splunk ES correlation search rules! Hi geeks,I integrated the TheHive and Cortex with Splunk ES for getting some alerts after triggering the correlation ... by zargaran Observer in Splunk Enterprise Security 05-23-2022 0 0	0	0
Unable to pull similar number 53726516638.77 (in billion) using chart for past 7 days? Unable to pull similar number 53726516638.77 (in billion) using chart for past 7 days. Dashboard only pulls data for ... by jimish Explorer in Splunk Enterprise Security 05-20-2022 0 4	0	4
Adding Threat Intelligence feed into Splunk ES in CSV format I'm currently trying to upload a malware feed into Threat Intelligence Management.The feed itself is being pulled fro... by JakeInfoSec Explorer in Splunk Enterprise Security 05-20-2022 1 2	1	2
How to Separate data from main index/HF? Hello everyone, I am trying to separate data getting into the main index from particular hosts. I am trying Transfor... by Zacknoid Explorer in Splunk Enterprise Security 05-20-2022 0 3	0	3
What is the command to check KVStore status? Facing issues with KVStore on Enterprise Security. Dashboards show an error "Unable to load results". Is there any co... by halleyglen Explorer in Splunk Enterprise Security 05-19-2022 3 8	3	8
How to troubleshoot unknown role warnings for 'ess_analyst' in Splunkd.log, even after uninstalling the Splunk App for Enterprise Security? Hi folks, I seem to have the remnants of a role, being called up, and failing to exist. The role is related to the E... by jravida Communicator in Splunk Enterprise Security 05-18-2022 1 3	1	3
How to put Limit on "edit Selected" option for the notable? While editing the Notable, we have options called "Edit selected". Can anyone help me with how to put the limit(numb... by Splunk2210 Observer in Splunk Enterprise Security 05-17-2022 0 0	0	0
Possibility of Multitenancy with ES I'm wondering about possibilities to set up a separate ES's for different teams. Due to some mergers and acquisitions... by PickleRick SplunkTrust in Splunk Enterprise Security 05-16-2022 0 2	0	2
Splunk ES - How to ddd a Status to Incident Review Dashboard? Under the 'Incident Review' dashboard, I want to add a Status type of 'False Positive' so I can easily find these and... by sswansonchtr Path Finder in Splunk Enterprise Security 05-12-2022 0 4	0	4
Is throttling based on trigger time? How do we decide? Hi,I have a CS, which runs every 6mins looking back -65m and -5m.. It triggered a notable alert, where for the same d... by Woodpecker Path Finder in Splunk Enterprise Security 05-12-2022 0 0	0	0
What should be the source type for AWS KMS logs to be CIM mapped fed to Splunk HEC through Kinesis Firehose connector? We have a setup where the AWS KMS logs are sent to Splunk HEC through below flow. We are getting JSON event format bu... by arangineni Explorer in Splunk Enterprise Security 05-11-2022 0 0	0	0
How to notify collaborators when some changes are done in investigation? Dear Splunkers, can you please advise or direct my to right place on following question:we need to send notification ... by Gene Path Finder in Splunk Enterprise Security 05-11-2022 0 2	0	2
How to write custom trigger condition? Hi Team, Could you please help me on this request. I have a correlation search working fine and need to exclude these... by praju New Member in Splunk Enterprise Security 05-10-2022 0 1	0	1
Single Enterprise Security searchhead cluster connected to 2 indexer clusters Hi All,I am investigating the possibility of consolidating our separate standalone ES Searchheads into a single clust... by waja1n0z1 Loves-to-Learn in Splunk Enterprise Security 05-04-2022 0 0	0	0
Trying to set default disposition of a notable correlation search Greetings.I've been trying to build a correlation search that sets a default disposition value when it runs but so fa... by mjones414 Contributor in Splunk Enterprise Security 05-03-2022 0 0	0	0
Getting error when trying to update notable event Has anyone found this error event? by sitthiporns Explorer in Splunk Enterprise Security 05-03-2022 0 0	0	0
Help with query to find out activity towards a particular URL query to find out activity towards a particular URL eg: URL - https://www.microsoft.com/en-us/security by cyber_Maddy Engager in Splunk Enterprise Security 05-02-2022 0 2	0	2