Splunk Enterprise Security

Community Activity

How do I configure MC to show me the Alerts & warnings I get on the Enterprise Security (ES)? Thanks a million. I have Monitoring Console in distributed mode on my Cluster Master. Need to learn how do I configure it to show Alert... by SamHTexas Builder in Splunk Enterprise Security 09-22-2021 0 1	0	1
How to know where a particular eventtype is used ? I have an eventtype that I want to delete, But before that I want to make sure that the eventtype isn't used anywhere... by zacksoft_wf Contributor in Splunk Enterprise Security 09-21-2021 0 1	0	1
Merge similar Notable events into one under Incident Review Hi All,Under Incident Review, is there a way to merge/consolidate triggered alerts of the same type and same host in... by neerajs_81 Builder in Splunk Enterprise Security 09-21-2021 0 1	0	1
Edit Action Dropdown on a notable event I am trying to add a dashboard to the action dropdown when you are in incident review under specific notables. How do... by Denorsmith Engager in Splunk Enterprise Security 09-21-2021 0 2	0	2
Enerprise Security posture is empty I have installed Enterprise Security App. I review Security Domain, in particular, Access and Network sections and I ... by m1ster1985 Explorer in Splunk Enterprise Security 09-21-2021 0 6	0	6
Upload Threat Intelligence not working Hi,I'm trying to upload a simple list of malicious filenames into ES Threat Intel.I have a csv file which I formatted... by Azeemering Builder in Splunk Enterprise Security 09-20-2021 1 2	1	2
Splunk Enterprise Security: How to retrieve ldap assets information? I tried to retrieve assets information of ldap so I used the search (I know that I must not to use search nt_host...)... by paola92 Explorer in Splunk Enterprise Security 09-19-2021 0 4	0	4
How to get a notable event's drilldown URL We're currently using Splunk ES, and would like to grab the link to a notable event's drilldown link on the ES Incide... by zyun Explorer in Splunk Enterprise Security 09-17-2021 0 1	0	1
Enterprise Security - Malware Operations - Clients By Product Version Hello! Can anyone please lend a hand with this issue? I'm still fairly new to this and am working my way through Fund... by securitypaul Explorer in Splunk Enterprise Security 09-17-2021 0 3	0	3
Why is "Threat file_intel" not capturing hash values from the Splunk search result? Hello, I wanted to reach out to you for assistance on Splunk ES threat_intel searches. Objective: We have endpoint ... by sayantabasak Explorer in Splunk Enterprise Security 09-17-2021 1 1	1	1
Cannot Set Up Splunk Enterprise Security Sandbox Hi,I want to set up my 7-day trial Splunk Enterprise Security Sandbox. But when I click the start trial. I am gettin... by mjgeneroso New Member in Splunk Enterprise Security 09-17-2021 0 0	0	0
Windows Data Mapping to the Update Data Model I'm in the process of implementing Splunk ES. We are using the Splunk_TA_windows and use the generate_windows_update... by dokaas_2 Communicator in Splunk Enterprise Security 09-16-2021 0 0	0	0
How do I make the correlation search generate notable event Hi,Based on my understanding, from the Splunk Guide, https://docs.splunk.com/Documentation/ES/6.6.0/Admin/Configureco... by xnx_1012 Explorer in Splunk Enterprise Security 09-16-2021 0 6	0	6
Notable Events in Incident Management Review not properly generated Hi to whomever find thisThe incident management review settings has repeated eventsWhat I did?I purpose logged in wit... by xnx_1012 Explorer in Splunk Enterprise Security 09-15-2021 0 0	0	0
Unable to rename app - Splunk Add On Builder After building a project/add-on based on the Standard naming convention of Splunk, i am facing the issue where i have... by vr2312 Builder in Splunk Enterprise Security 09-15-2021 0 2	0	2
Migrate ES correlation rules to a custom app I would have to move my custom Correlation rules to a custom TA-foo appMy correlation searches comprises of:custom r... by soumyasaha25 Contributor in Splunk Enterprise Security 09-15-2021 0 1	0	1
Inline table not showing in Correlation Search Email Notification I created a correlation search with only two pipes, table and rename. I added inline table to the email notification ... by hperez Explorer in Splunk Enterprise Security 09-13-2021 0 1	0	1
Notable event title not containing the variable. Hello all,I am struggling with customizing my Splunk ES's Incident Review panel. I have integrated Suricata IDS logs ... by b_chris21 Communicator in Splunk Enterprise Security 09-13-2021 0 1	0	1
How do I view the Server classes in Deployment server & see their details of what they contain? Thank u very much I am getting started using DS to deploy new configurations to UFs. Need to view the list of Server classes , what the... by SamHTexas Builder in Splunk Enterprise Security 09-13-2021 0 2	0	2
How can I monitor VMware Horizon View with Splunk? I’m running VMWare Horizon View 7 in my organization. Now with COVID-19 Shelter in place we all need to WFH. How do I... by canalesjac Path Finder in Splunk Enterprise Security 09-10-2021 3 13	3	13
Do Datasets in ES ever need updating? How do I update the ones that need it please? Thank u in advance. I notice some include .csv files. Do these .csv s need updating? Or do they stay stale? How are Data sets updated? Pl... by SamHTexas Builder in Splunk Enterprise Security 09-10-2021 0 3	0	3
Macro definition = () Hi all,Just note that the macro 'cim_Authentication_indexes` of Splunk_SA_CIM has definition like following:[cim_Auth... by stwong Communicator in Splunk Enterprise Security 09-09-2021 0 6	0	6
Cannot create Notable Event Hello, Whenever I tried to create a notable event by "Configure -> Incident Management -> New Notable Event", the web... by xnx_1012 Explorer in Splunk Enterprise Security 09-09-2021 0 0	0	0
HTML Web form Hello Splunkers, I am looking for an html page in a dashboard with ID, ID_Name, an other fields with Text box, dropdo... by vamshikn72 Explorer in Splunk Enterprise Security 09-08-2021 0 0	0	0
Trend Micro Apex One How can I integrate Trend micro apex one with Splunk Enterprise? by akashsaxena454 New Member in Splunk Enterprise Security 09-08-2021 0 0	0	0