Splunk Enterprise Security

Community Activity

What is the purpose of ess_admin role in splunk ES when it is advised not to assign it to users? I'm trying to get why ess-admin role is present when it should not be assigned to users? by rupeshn Explorer in Splunk Enterprise Security 10-07-2021 0 9	0	9
Splunk Integration with CAUIM monitoring tools Hi There Experts , In our current environment we have Splunk Integration with CA UIM monitoring tools to send Splunk ... by Ashoo Loves-to-Learn in Splunk Enterprise Security 10-07-2021 0 2	0	2
Looking for O365 use cases in Splunk I am looking for O365 use cases related to MS teams, Sharepoint, Exchange , One drive, Currently data is populate in ... by sahiltcs Path Finder in Splunk Enterprise Security 10-06-2021 0 1	0	1
Can I create out of box use cases from Splunk CIM data models ? Is it possible to use data models from Common Information Model to use cases in splunk, if so, how can we do that by jm1 New Member in Splunk Enterprise Security 10-06-2021 0 1	0	1
Default Threat Intelligence feeds not visible in ES Hello,As per ES official documentation, it says below threat intel feeds are enabled by default. Mozilla Public Suffi... by neerajs_81 Builder in Splunk Enterprise Security 10-05-2021 0 0	0	0
Splunk correlation search with throttling generating duplicates on an ES clustered environment We recently moved from a stand-alone ES splunk search head to a clustered splunk ES search head, and we've started to... by mjones414 Contributor in Splunk Enterprise Security 10-05-2021 1 2	1	2
What is the latest stable release of splunk 8.x? I have heard of some stability issues. What is the latest stable release of splunk 8.x? We are planning a version upgrade from 7.3.5 to 8.x. I have heard ... by mookiie2005 Communicator in Splunk Enterprise Security 10-05-2021 1 1	1	1
How to remove the unwanted threat group and threat category list from the dropdown of the threat activity feed? And also how to remove the data from ip_intel list ? HI Splunkers, In our environment, We have couple of unwanted threat groups and threat category list populated in the... by renjujacob88 Path Finder in Splunk Enterprise Security 09-30-2021 0 1	0	1
Can I convert duration in minutes into days, hours, minutes Hi, I have a final value in minutes, but I'd like to display this in a more user friendly manner, i.e; 1680 minutes... by jacqu3sy Path Finder in Splunk Enterprise Security 09-30-2021 0 11	0	11
Status Changing on Old Notable Events When we create new alerts for testing, we have the correlation search create the notable event with a status of "Test... by skippycat Engager in Splunk Enterprise Security 09-30-2021 1 0	1	0
ServiceNow Event Integration Hi Splunkers, How to create Incidents on SNOW from Splunk SPL? We have "ServiceNow Event Integration" alert action in... by vamshikn72 Explorer in Splunk Enterprise Security 09-28-2021 0 1	0	1
updated to newer SES version = added step when editing a notable :( so before the update (was v6.4.1) we would edit the incident in 'incident review' -> add a comment or change some st... by splunker1980 New Member in Splunk Enterprise Security 09-27-2021 0 0	0	0
Setup Validation & Review Hi All,Any advice on how to go about finding coverage gaps in a typical ES installation ?We r ingesting logs from AWS... by neerajs_81 Builder in Splunk Enterprise Security 09-27-2021 0 0	0	0
In Intelligence Downloads setting what is Maximum age? When I configuring threat feeds in ES . In Intelligence Downloads setting there is Maximum age for threat intel dow... by Pavankumar Loves-to-Learn Lots in Splunk Enterprise Security 09-22-2021 0 1	0	1
How do I configure MC to show me the Alerts & warnings I get on the Enterprise Security (ES)? Thanks a million. I have Monitoring Console in distributed mode on my Cluster Master. Need to learn how do I configure it to show Alert... by SamHTexas Builder in Splunk Enterprise Security 09-22-2021 0 1	0	1
How to know where a particular eventtype is used ? I have an eventtype that I want to delete, But before that I want to make sure that the eventtype isn't used anywhere... by zacksoft_wf Contributor in Splunk Enterprise Security 09-21-2021 0 1	0	1
Merge similar Notable events into one under Incident Review Hi All,Under Incident Review, is there a way to merge/consolidate triggered alerts of the same type and same host in... by neerajs_81 Builder in Splunk Enterprise Security 09-21-2021 0 1	0	1
Edit Action Dropdown on a notable event I am trying to add a dashboard to the action dropdown when you are in incident review under specific notables. How do... by Denorsmith Engager in Splunk Enterprise Security 09-21-2021 0 2	0	2
Enerprise Security posture is empty I have installed Enterprise Security App. I review Security Domain, in particular, Access and Network sections and I ... by m1ster1985 Explorer in Splunk Enterprise Security 09-21-2021 0 6	0	6
Upload Threat Intelligence not working Hi,I'm trying to upload a simple list of malicious filenames into ES Threat Intel.I have a csv file which I formatted... by Azeemering Builder in Splunk Enterprise Security 09-20-2021 1 2	1	2
Splunk Enterprise Security: How to retrieve ldap assets information? I tried to retrieve assets information of ldap so I used the search (I know that I must not to use search nt_host...)... by paola92 Explorer in Splunk Enterprise Security 09-19-2021 0 4	0	4
How to get a notable event's drilldown URL We're currently using Splunk ES, and would like to grab the link to a notable event's drilldown link on the ES Incide... by zyun Explorer in Splunk Enterprise Security 09-17-2021 0 1	0	1
Enterprise Security - Malware Operations - Clients By Product Version Hello! Can anyone please lend a hand with this issue? I'm still fairly new to this and am working my way through Fund... by securitypaul Explorer in Splunk Enterprise Security 09-17-2021 0 3	0	3
Why is "Threat file_intel" not capturing hash values from the Splunk search result? Hello, I wanted to reach out to you for assistance on Splunk ES threat_intel searches. Objective: We have endpoint ... by sayantabasak Explorer in Splunk Enterprise Security 09-17-2021 1 1	1	1
Cannot Set Up Splunk Enterprise Security Sandbox Hi,I want to set up my 7-day trial Splunk Enterprise Security Sandbox. But when I click the start trial. I am gettin... by mjgeneroso New Member in Splunk Enterprise Security 09-17-2021 0 0	0	0