Splunk Enterprise Security

Community Activity

is there a dashboard for tracking active Directory group changes and local host group changes? We want to be able to use Splunk as an auditing tool for our groups local and to Active Directory groups. If changes ... by jarose New Member in Splunk Enterprise Security 05-22-2020 0 3	0	3
Splunk Enterprise security Incident Review table not showing. Hi All,Would like to know what causes this issue , please see screenshot attached.There's an event "42" showing and t... by jadengoho Builder in Splunk Enterprise Security 05-21-2020 2 22	2	22
Splunk Enterprise Security cluster's member going up and down In the cluster of ES, members of cluster randomly have get this error: Search Head Clustering Service Not ReadyPlease... by sabaKhadivi Path Finder in Splunk Enterprise Security 05-20-2020 0 0	0	0
How to detect url/domain category change in proxy logs Hi Everyone, I want to create a splunk query which can detect url/domain category change in the proxy logs within las... by vicky2903 New Member in Splunk Enterprise Security 05-20-2020 0 3	0	3
Windows Universal Forwarder GPO Hello I am having issues with my agent authentication and installation.I set up a service account on our domains. Cre... by a1servinem777 New Member in Splunk Enterprise Security 05-19-2020 0 0	0	0
How to calculate the time between the notable event state changes? I am trying to figure out a way to calculate the time for: Time taken for a reviewer to assign the notable ticket fro... by ajaynyay New Member in Splunk Enterprise Security 05-19-2020 0 3	0	3
dynatrace to splunk Hi team,I am receiving multiple events from different servers to dynatrace. so how can I forward all those events fro... by punithjigali Explorer in Splunk Enterprise Security 05-19-2020 0 1	0	1
Splunk Dashboard - Single dropdown or input resize Taking a cue from this thread, https://answers.splunk.com/answering/823859/view.html The code <html> <style> ... by verbal_666 Builder in Splunk Enterprise Security 05-19-2020 0 2	0	2
snmp modular input liscense key how to use the liscense key for the snmp modular input , it is giving me an error other options to send snmp events a... by punithjigali Explorer in Splunk Enterprise Security 05-19-2020 0 0	0	0
Confirming correct integration of manually uploaded STIX file Hi Splunkers. I've manually uploaded a STIX file into ES. The file has uploaded successfully (file can be seen in /o... by torowa Path Finder in Splunk Enterprise Security 05-18-2020 0 0	0	0
Find events from two indexes based on a time range I have a need to reconcile Splunk ES rule changes. I am using the rest API to pull the "updated" rule changes. The ... by wtaylor149 Explorer in Splunk Enterprise Security 05-18-2020 0 1	0	1
Best Method of Associating External IP with a Description Hi, I'm not exactly sure what is the best way to approach this issue. I have a list of external IP address along with... by luongg Explorer in Splunk Enterprise Security 05-18-2020 0 2	0	2
How to turn on use cases using Splunk Security Essentials? I have identified the log sources and corresponding use cases and book marked.e.g. Basic Brute Force Detection for th... by jas0049 New Member in Splunk Enterprise Security 05-18-2020 0 7	0	7
Want to add severity field in vulnerability by age dashboard in ES Splunk. We have configure ES Splunk in which most of the dashboard are predefined. so Want to add severity field in vulnerabi... by adisxn01 New Member in Splunk Enterprise Security 05-18-2020 0 0	0	0
Send all reports from last hour in an email Hello everyone,current scenario:Reports run every 15 minutes. The output are charts. We take screenshot of those repo... by kirthi_d Engager in Splunk Enterprise Security 05-17-2020 0 6	0	6
How to modify data model in CIM without doing so directly in CIM? Hello, I have a question about modification of data model in CIM: I would like to add one child dataset to DM "Change... by lukasmecir Path Finder in Splunk Enterprise Security 05-15-2020 0 7	0	7
Enterprise Security malware dashboard not populating I'm trying to get the Splunk Enterprise Security Malware dashboards to populate: I'm ingesting data from symantec us... by montydo Explorer in Splunk Enterprise Security 05-15-2020 0 1	0	1
calculations on events for daily alert Hi team, I need to create a alert, where if my daily count is less than 30 % of monthly count average... of a particu... by punithjigali Explorer in Splunk Enterprise Security 05-15-2020 0 1	0	1
user using outside VPN acess can't access externl mail server Good morning,since I've been working from home using VPN access to connect to the office I noticed, I haven't been ab... by cosm0630 New Member in Splunk Enterprise Security 05-15-2020 0 1	0	1
asset_lookup_by_str keeps changing the number of results Hello Experts,Currently I have configured 2 source files for Asset Center and also have configured searches for those... by Ajinkya1992 Path Finder in Splunk Enterprise Security 05-14-2020 0 1	0	1
FIELDALIAS-app = networkConnections{}.applicationName AS app never filled Hello, This app contains a list of Field aliases including a field alias for the field "networkConnections{}.applicat... by Azeemering Builder in Splunk Enterprise Security 05-14-2020 0 0	0	0
Line Breake issue Could you provide me how it can write line break and Time regex below logs . 2020-09-26 19:27:33,092 DEBUG com.edifec... by khalidewaidah Explorer in Splunk Enterprise Security 05-13-2020 0 1	0	1
Can you make custom eval functions? I was curious, and was not able to find an answer online or here, if you are able to create custom eval subcommands. ... by jamolson Path Finder in Splunk Enterprise Security 05-13-2020 1 2	1	2
Splunk Incident Review Adaptive Response not Working Hi splunkers,When ı research an incident and press the ESCU-Contextualize and ESCU-Contextualize return a empty page ... by burakatabay Path Finder in Splunk Enterprise Security 05-13-2020 1 5	1	5
deadlock events which events need to be indexed by microsoft sql add on to monitor dead lock in splunk and how?? by punithjigali Explorer in Splunk Enterprise Security 05-13-2020 0 0	0	0