Splunk Enterprise Security

Community Activity

Risk Based alerting in SPLUNK ES I want to enable risk based alerting as a part of threat hunting.Usecase- lf a malicious file is transmitted, risk sc... by snsaxena Loves-to-Learn Lots in Splunk Enterprise Security 06-15-2021 0 1	0	1
How to convert hours into days Hi, I have the following duration format that i'd like to convert into days. Initial Format Desired Forma... by yvassilyeva Path Finder in Splunk Enterprise Security 06-14-2021 0 2	0	2
Splunk ES Notable events not getting triggered Hello Everyone, I'm trying to use Splunk ES feature for AWS cloudtrail data. I'm using default main index for cloudtr... by diwakar Engager in Splunk Enterprise Security 06-11-2021 0 2	0	2
How to combine two fields values into one Hi,I have the following table:status countCANCELLED ... by yvassilyeva Path Finder in Splunk Enterprise Security 06-10-2021 0 4	0	4
Correlation searches scheduling to overcome downtimes and event delays Hello, Hello, Any suggestions on how to configure the correlation search schedule in a way that will not be affected ... by tibi Observer in Splunk Enterprise Security 06-10-2021 0 2	0	2
Threatlist scheme error - unable to initialize modular input Hello,There is an error "unable to initialize modular input "threatlist"" and it's blocking all the Threat Intel feat... by acadea Explorer in Splunk Enterprise Security 06-10-2021 0 1	0	1
Does Splunk automatically tag identities with watchlist? We recently had Splunk PS help set up ES in our environment, but all of the managed look-ups the PS person created no... by cmcneilw New Member in Splunk Enterprise Security 06-09-2021 0 0	0	0
Splunk Event Log is Gibberish I'm using Splunk for Snort and I'm finding that Splunk is interpreting the Snort logs as gibberish, see below. Any id... by ScottLA66 New Member in Splunk Enterprise Security 06-09-2021 0 0	0	0
non-owner mailbox access for Microsoft Exchange we have one audit point that non owner users like domain admin, exchange admin's are opening other's mailboxes and th... by rashid47010 Communicator in Splunk Enterprise Security 06-08-2021 0 4	0	4
How to ignore unknown objects in Risk adaptive response? Hi,There're some incidents hit my threat intelligence IP, e.g. dest. That's why Threat Activity notable event is trig... by phil_wong Explorer in Splunk Enterprise Security 06-07-2021 0 2	0	2
Notable events ES Hi Folks,I have one question, it's possible add an response action when the notable event change status?Example:I hav... by aasabatini Motivator in Splunk Enterprise Security 06-07-2021 0 0	0	0
Omit IP addresses from SPL What is the best way to omit internal IPs within this SPL? There are a lot of internal source IP hits that come up wh... by tkbrown Engager in Splunk Enterprise Security 06-07-2021 0 1	0	1
Why does latest version of ES CU app indicates exploring Analytical Stories through ES or Sec Essentials App ? Just downloaded the latest version of ES Content Update app and noticed the following message:Explore the Analytic St... by dm1 Contributor in Splunk Enterprise Security 06-02-2021 0 1	0	1
Separate ES App "Incident Review Dashboard" Hey Splunkers,any possibility of having 2 separate incident review dashboard- 1st for production usecase- 2nd for Dev... by General_Talos Path Finder in Splunk Enterprise Security 05-20-2021 0 0	0	0
Not to use RAID5 on SSD when using SmartStore. Why avoid RAID5 on SSD when using SmartStore? by rbal_splunk Splunk Employee in Splunk Enterprise Security 05-20-2021 0 1	0	1
Raw data on Enterprise Security Hello guys! Does anyone know how I can get (raw data \| raw log) from a dataset on Enterprise Security?On Splunk Ente... by stealth_eth0 New Member in Splunk Enterprise Security 05-19-2021 0 3	0	3
Azure Implementation We want to implement Splunk cloud , do we need to implement IDMOur data would come from the Azure Cloud and our Data ... by hermontwd Observer in Splunk Enterprise Security 05-19-2021 0 0	0	0
How does Splunk SE impact existing infrastructure performance? Hello,I have been searching for hours but I have yet to come across to an answer to my question:- How does Splunk SE ... by ITAdminBart Engager in Splunk Enterprise Security 05-19-2021 0 1	0	1
Why doesn't the Splunk Add-on for Microsoft Windows DNS populate the Network Resolution data model? I'm not seeing the Network Resolution/DNS datamodel/dataset populated from the Splunk Add-on for Microsoft Windows DN... by ejwade Contributor in Splunk Enterprise Security 05-14-2021 1 2	1	2
Splunk ES - Incident Review (for SLA) Sorry to ask this question if it has been talked about before - I have a Splunk ES installation that we use the "Inci... by sherpedz Loves-to-Learn Lots in Splunk Enterprise Security 05-13-2021 0 0	0	0
Integration of "Investigation" ES functionality into a custom splunk app Hello,I am wanting to write an app for Splunk ES that can leverage the ability to integrate the investigation toolbar... by mjones414 Contributor in Splunk Enterprise Security 05-11-2021 0 0	0	0
How do I backup the Splunk Enterprise Security app. What components needs to be backed up and how often? How do I backup the Splunk Enterprise Security app. What components needs to be backed up and how often? I have alrea... by SamHTexas Builder in Splunk Enterprise Security 05-11-2021 0 1	0	1
How to create custom app/addon(steps) using CLI and push to SHC members using deployer I am a Advanced beginner to splunk and i want to create custom app/addon in my search head cluster environment and pu... by obais9346 Engager in Splunk Enterprise Security 05-07-2021 0 3	0	3
Configure FS-ISAC TAXXI Feeds in Splunk ES I am working on configuring the TAXXI Feeds. My Post argument is as below:collection="curated-ragw" earliest="-7d" ke... by dwibedi03 Explorer in Splunk Enterprise Security 05-06-2021 0 0	0	0
Splunk ES 4.7.6 - How do we track active investigations via lookup? Is there a lookup I can use to create a custom table of active investigations? I am trying to create a table that sh... by DEAD_BEEF Builder in Splunk Enterprise Security 05-05-2021 2 8	2	8