Splunk Enterprise Security

Splunk Enterprise Security
Community Activity
b_chris21
Hello all,I am struggling with customizing my Splunk ES's Incident Review panel. I have integrated Suricata IDS logs ...
by b_chris21 Communicator in Splunk Enterprise Security 09-13-2021
0 1
0
1
SamHTexas
I am getting started using DS to deploy new configurations to UFs. Need to view the list of Server classes , what the...
by SamHTexas Builder in Splunk Enterprise Security 09-13-2021
0 2
0
2
canalesjac
I’m running VMWare Horizon View 7 in my organization. Now with COVID-19 Shelter in place we all need to WFH. How do I...
by canalesjac Path Finder in Splunk Enterprise Security 09-10-2021
3 13
3
13
SamHTexas
I notice some include .csv files. Do these .csv s need updating? Or do they stay stale? How are Data sets updated? Pl...
by SamHTexas Builder in Splunk Enterprise Security 09-10-2021
0 3
0
3
stwong
Hi all,Just note that the macro 'cim_Authentication_indexes` of Splunk_SA_CIM has definition like following:[cim_Auth...
by stwong Communicator in Splunk Enterprise Security 09-09-2021
0 6
0
6
xnx_1012
Hello, Whenever I tried to create a notable event by "Configure -> Incident Management -> New Notable Event", the web...
by xnx_1012 Explorer in Splunk Enterprise Security 09-09-2021
0 0
0
0
vamshikn72
Hello Splunkers, I am looking for an html page in a dashboard with ID, ID_Name, an other fields with Text box, dropdo...
by vamshikn72 Explorer in Splunk Enterprise Security 09-08-2021
0 0
0
0
akashsaxena454
How can  I integrate Trend micro apex one with Splunk Enterprise?
by akashsaxena454 New Member in Splunk Enterprise Security 09-08-2021
0 0
0
0
saharzare
I see this :/opt/splunk/etc/apps/splunk_essentials_8_2/appserver/static/exampleInfo.jsondiffers/opt/splunk/etc/apps/s...
by saharzare Engager in Splunk Enterprise Security 09-07-2021
0 1
0
1
momomok
Hi,Ever since upgrading to ES 6.2, there has been a problem bugging our team.Whenever we select one of the notable ev...
by momomok Loves-to-Learn in Splunk Enterprise Security 09-05-2021
0 0
0
0
StanD3sec
I can CRUD threat intel collection rows with ESS REST API(such as /services/data/threat_intel/item/ip_intel), and I c...
by StanD3sec Loves-to-Learn in Splunk Enterprise Security 09-03-2021
0 0
0
0
SamHTexas
Need help with KVstore status. Why do I get "This health check item is not applicable" in MC in my ES while I have ma...
by SamHTexas Builder in Splunk Enterprise Security 09-03-2021
0 1
0
1
inayath_khanin1
Identity: 314 assets are currently exceeding the field limits set in the Asset and Identity Management page. Data tru...
by inayath_khanin1 Explorer in Splunk Enterprise Security 09-03-2021
0 2
0
2
dominikatvastli
Hi,I want to see my data in the ES dashboard Security Domains -> Endpoint -> Endpoint Changes.I created the following...
by dominikatvastli Path Finder in Splunk Enterprise Security 09-03-2021
0 2
0
2
SamHTexas
I getting indications that Splunk Ent. / ES was restarted. Is it possible to find when & by whom? Thank u very much f...
by SamHTexas Builder in Splunk Enterprise Security 09-02-2021
0 1
0
1
zacksoft_wf
Out of the dataModels provided with Enterprise Security, one of the accelerated datamodel suddenly has a very high ru...
by zacksoft_wf Contributor in Splunk Enterprise Security 09-02-2021
0 5
0
5
zyun
I'm looking to update an artifact in a custom function. The closest thing that's supported is being able to update a ...
by zyun Explorer in Splunk Enterprise Security 09-01-2021
0 0
0
0
SamHTexas
This posting did not let me share the search string due to it containing HTML code etc. Any advice is appreciated. Th...
by SamHTexas Builder in Splunk Enterprise Security 09-01-2021
0 0
0
0
SamHTexas
Why should data models all be accelerated? What about the built-in Data Models?
by SamHTexas Builder in Splunk Enterprise Security 09-01-2021
0 1
0
1
clueless535627
from a SOC perspective what health checks are important for them to perform? i understand the basic checks from splun...
by clueless535627 New Member in Splunk Enterprise Security 08-30-2021
0 0
0
0
SamHTexas
I need to learn the process of configuring an app to use a certain Index please. Thank u 
by SamHTexas Builder in Splunk Enterprise Security 08-25-2021
0 1
0
1
SocAnalyst
Hello sir,i just installed the add on "Alien vault check OTX" in my splunk enterprise.i have integrated my api key, b...
by SocAnalyst New Member in Splunk Enterprise Security 08-25-2021
0 0
0
0
VasukiPramod
Tokens in notable event titles and descriptions not getting expanded to include the values of the tokens on the Incid...
by VasukiPramod Explorer in Splunk Enterprise Security 08-24-2021
0 6
0
6
sahiltcs
We have onboarded Alicloud data in Splunk and looking for use cases creation. Is there any ALicloud use cases doc for...
by sahiltcs Path Finder in Splunk Enterprise Security 08-24-2021
0 0
0
0
lucanzano
Hello, we have created many custom correlation searches in our client's deployed instance. Right now they are creatin...
by lucanzano Loves-to-Learn Everything in Splunk Enterprise Security 08-24-2021
0 3
0
3
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...
Top Solution Authors