Splunk Enterprise Security

Community Activity

searching and alerting on ip_intel Hi, Does anyone know if there is an efficient way to incorporate ip_intel into a search/query. I want to set up an a... by hbfblueteam New Member in Splunk Enterprise Security 05-05-2020 0 3	0	3
Why are the Data Models not building? I have recently rebuilt our server that hosts the Enterprise Security app here and I am having trouble with some of t... by mcxrisley08 Path Finder in Splunk Enterprise Security 05-05-2020 0 4	0	4
How do I converting a "curl" command to a collection configuration in "Splunk Add-On Builder" console? Hi, I really need help with this issue. I need to collect logs using REST from a web resource. I'm trying for a lot o... by yossefn Path Finder in Splunk Enterprise Security 05-05-2020 0 8	0	8
How to view my VulnerabilityTitle count deltas over time with ranking Ok so bear with me as I explain. I would like to view my VulnerabilityTitle count deltas over time. So for instance, ... by jlovik Explorer in Splunk Enterprise Security 05-05-2020 0 6	0	6
Fieldsummary output : remove columns I dont need. eventtype=osquery_osquery name="pack_incident_response_*" earliest=-5m \| fieldsummary output: A table contains mult... by john_shashank New Member in Splunk Enterprise Security 05-05-2020 0 11	0	11
Cisco Firepower eStreamer eNcore Add-on - URL field extraction issue? Our URLs are not being extracted from our firepower logs. The url field always shows "unknown" even when there is a U... by tromero3 Path Finder in Splunk Enterprise Security 05-04-2020 0 4	0	4
CEF parsing on under Splunk Enterprie Security App I have strange issue, I am receiving logs in CEF format from fireeye under index=fireeye. On search Head I am seeing ... by riqbal47010 Path Finder in Splunk Enterprise Security 05-04-2020 0 1	0	1
Assets with overlapping DHCP Addresses Merging in ES 6 We use SA-ldapsearch to pull Active Directory data into the ES Assets & Identity framework. We do not currently inges... by stroud_bc Path Finder in Splunk Enterprise Security 05-03-2020 3 7	3	7
After Upgrade ES to 6.1.0 Getting error as Health Check: Intelligence download of "icann_top_level_domain_list" has failed on host XXX in SA-ThreatIntelligence Only for the stanza icann_top_level_domain_list , we are getting error "threat list download failed after multiple re... by schandrasekar Loves-to-Learn in Splunk Enterprise Security 05-03-2020 0 0	0	0
how to search a file/folder permissions changed on a file share server? Auditing has already been enabled but we are having issues to know who changed the permissions by humi0912 New Member in Splunk Enterprise Security 05-01-2020 0 1	0	1
Losing data from URL-based Threat Intelligence Feed Hi All, Looking for some help troubleshooting some odd behaviour around storing IOCs from a custom URL-based Threat ... by aingragunathan Engager in Splunk Enterprise Security 04-30-2020 0 0	0	0
How to find Non-Primary and Primary bucket copies on the peer nodes ? How to find Non-Primary and Primary bucket copies on the peer nodes ? I'm new to the Splunk, could someone please h... by nagadaksesh New Member in Splunk Enterprise Security 04-30-2020 0 2	0	2
Spunk App for CEF format not detecting on CyberArk PTA Hello, Splunk App for CEF is installed on Splunk HF, I did all the field mapping to the Log which is required for Cy... by arjunhunurkar New Member in Splunk Enterprise Security 04-30-2020 0 3	0	3
Health Check:msg="A script exited abnormally with exit status:1" Health Check:msg="A script exited abnormally with exit status:1" are poppling for below inputs input=".opt/splunk/et... by schandrasekar Loves-to-Learn in Splunk Enterprise Security 04-29-2020 0 0	0	0
Slack Notification Alert: Triggered Alert not sending notification to slack hi All, After setting up the incoming webhooks in the slack and provided the webhook url in the Slack setup configur... by datamine Loves-to-Learn Lots in Splunk Enterprise Security 04-29-2020 0 0	0	0
Passing Variable to Inputlookup I am running a query to find the list of users that received an email from a particular email address. This is workin... by geekf Path Finder in Splunk Enterprise Security 04-28-2020 0 2	0	2
Threat Activity in the ES app stopped to populate data i have recently upgraded SPlunk from 7.1.1 to 7.3.4 and ES from 5.2.2 to 5.3.1, but after the upgrade i can see that ... by soumyasaha25 Contributor in Splunk Enterprise Security 04-28-2020 0 0	0	0
Bucket Flap Hello, I'm new here and I wanted some help for this issue. My incident is getting many errors for a bucket replicatio... by adol83 Explorer in Splunk Enterprise Security 04-28-2020 1 2	1	2
LDAP Search= Command How do you use the search= command with lpdasearch or lpdafilter? I seen examples where they are using search="(objec... by keldridg2 New Member in Splunk Enterprise Security 04-27-2020 0 1	0	1
Is it possible to filter data coming through Elasticsearch Modular Input without changing the configuration or data indices on ES? Hi All, I have enabled the Modular Input for Elasticsearch(ES) and I am able to get in the data. My sample data is m... by prachisaxena Explorer in Splunk Enterprise Security 04-27-2020 0 0	0	0
Compare today's values to the week's median without join Hello there, I'm have a search that get the events atributed to "N" number of users, and I would like to compare the... by omarguzmancamac Engager in Splunk Enterprise Security 04-27-2020 0 5	0	5
CBResponse app compatibility plans for Splunk 8.x? Will the CB Response app be compatible with Splunk 8.x anytime soon? Or does anyone have a workaround for errors that... by ch1221 Path Finder in Splunk Enterprise Security 04-25-2020 1 2	1	2
ignore timestamp greater than 2 days two time fields per event: _time (default eventfield for Splunk) occurtime (timestamp within body of event) I o... by arikanter Observer in Splunk Enterprise Security 04-24-2020 0 2	0	2
Title in Email from Correlation Search I have looked at the SPLUNK documentation (https://docs.splunk.com/Documentation/Splunk/7.2.9/Alert/EmailNotification... by willadams Contributor in Splunk Enterprise Security 04-24-2020 0 0	0	0
Is it advisable to implement Splunk ES using SmartStore in a 2-site configuration? According to https://docs.splunk.com/Documentation/Splunk/8.0.3/Indexer/AboutSmartStore#Current_restrictions_on_Smart... by elliottj1 New Member in Splunk Enterprise Security 04-24-2020 0 0	0	0