Splunk Enterprise Security

Community Activity

Does an IOC get removed from ip_intel if you remove it from the local lookup Hi all, So I followed the guide here https://docs.splunk.com/Documentation/ES/4.5.1/User/Configureblocklists in ord... by cybersecrav New Member in Splunk Enterprise Security 01-23-2020 0 0	0	0
Is it possible to list what source my correlation search is based on? Hello, We'd like to help our analysts to tell which correlation search is impacted in case of log source issue. But ... by woodentree Communicator in Splunk Enterprise Security 01-23-2020 0 2	0	2
zScaler "url" field lacks protocol and doesn't match threat lists in ES We use the zScaler proxy product and have it configured with NSS to collect logs in Splunk Enterprise. We also downlo... by stroud_bc Path Finder in Splunk Enterprise Security 01-22-2020 0 1	0	1
Subtracting Two Dates to get a Difference in Days Hello, I'd like to obtain a difference between two dates. One of these dates falls within a field in my logs called... by itsmevic Communicator in Splunk Enterprise Security 01-22-2020 0 6	0	6
Where can I find a list of the standard use cases Splunk comes with? I'm looking for a list of "out of the box" use cases that Splunk comes with - to do a gap analysis between that, and ... by marktait1971 Explorer in Splunk Enterprise Security 01-22-2020 0 6	0	6
How to upgrade add-ons on Indexers and Forwarders after Splunk ES upgrade ? After upgrading ES search head, what is the recommended way to upgrade add-ons on Indexers and forwarders ? Based on... by damode Motivator in Splunk Enterprise Security 01-22-2020 0 5	0	5
First Time Seen Running Windows Service Alert On Splunk Enterprise Security Hi Splunkers, We have realized our "First Time Seen Running Windows Service " Correlation search seen below has been... by burakatabay Path Finder in Splunk Enterprise Security 01-22-2020 0 2	0	2
Splunk Enterprise Security: Lookups and other props/transforms Hello, I've run into an issue lately where I want both my search heads and Enterprise Security to show the same fie... by arlombar Explorer in Splunk Enterprise Security 01-21-2020 0 3	0	3
Windows AD Logs - Need actor /recipient details for "admonEventType=Update" ? How to get the list of username and domain of both the actor (who makes the changes) and the recipient (which object ... by vn_g Path Finder in Splunk Enterprise Security 01-20-2020 0 0	0	0
Create theHive Alert Splunk app is not working Hi, I'm trying to use the app - Create theHive Alert for Splunk. I can see the alerts being generated(within Splunk) ... by aashnaa New Member in Splunk Enterprise Security 01-20-2020 0 0	0	0
Exclude list of dest IP from search using input lookup but correlation is alerting excluded dest IP Hi floks, i have exclude dest IP from search which is working fine but in correlation it is still triggering alert. ... by DawoodUlex New Member in Splunk Enterprise Security 01-20-2020 0 2	0	2
LIKE and like() Just want to clear this up so I am not mistaken. Are the two statements equivalent: \| where like (foo, "bar") and... by ak1508 Explorer in Splunk Enterprise Security 01-20-2020 1 2	1	2
Duration between login and logout in an application I need to take out the duration between login and logout of a user from an application. there are two senario for the... by ayushchoudhary Path Finder in Splunk Enterprise Security 01-20-2020 0 3	0	3
'Sourcetype= stash' value in 'Enterprise Security' incidents. in enterprise security in incidents additional fields for all incidents i am seeing Sourcetype= stash its not sh... by vikram1583 Explorer in Splunk Enterprise Security 01-19-2020 0 1	0	1
Trying to create a csv with time, count, and OS Trying to create a csv file with information that includes the total count of systems, OS, and current time \| inputl... by mlozano09 Engager in Splunk Enterprise Security 01-17-2020 0 1	0	1
Filtering on _indextime in data model tstats search - field appears to be missing from some data? I have an alert which uses a tstats accelerated data model search to look for various types of suspicious logins. Sin... by stroud_bc Path Finder in Splunk Enterprise Security 01-17-2020 2 6	2	6
Threat intelligence IPs/URL to be searched against poxy logs I am working on a specific requirement where outgoing proxy connections towards Threat list IPs/URLs need to be alert... by pdafale_lgiasup New Member in Splunk Enterprise Security 01-16-2020 0 1	0	1
Can I use Splunk Enterprise to set up monitoring of a honeypot? Hi, Was wondering that would i be able to use Splunk Enterprise to set-up monitoring of a honeypot activities, or w... by 5plunked Explorer in Splunk Enterprise Security 01-16-2020 0 2	0	2
Facing problem during configure "Splunk Enterprise Security Suite" Hi Experts, I try to install "Splunk Enterprise Security Suite" in my standalone environment. For this I follow: ht... by arun_kant_sharm Path Finder in Splunk Enterprise Security 01-16-2020 1 3	1	3
GDPR Use Case Library Enterprise Security In my company we have Enterprise Security under contract and in the use case library we see that compliance use cases... by dgomez91 New Member in Splunk Enterprise Security 01-16-2020 0 2	0	2
Distinct Count combined with List Is it possible to take a distinct count of something, then list this by an additional value by day? something like t... by jacqu3sy Path Finder in Splunk Enterprise Security 01-16-2020 0 4	0	4
ES 6 fresh install - how to populate assets KV store Hi there. I have used previous versions of ES, and am familiar with importing a CSV of my identities and assets. I ... by sbridge Explorer in Splunk Enterprise Security 01-15-2020 0 2	0	2
Can splunk be 100% CIM Compliance? My team is always complainin that splunk is not cim compliance. Most of data sources in splunk such as symantec endpo... by ujuka New Member in Splunk Enterprise Security 01-15-2020 0 3	0	3
Splunk_TA_windows puts failed logon events in Change Datamodel Hi Splunkers, It is strange to me and I hope someone can explain - what is the reason for ingesting Windows failed lo... by asobiesiak New Member in Splunk Enterprise Security 01-14-2020 0 0	0	0
How i can rename the field output value in splunk. how i can rename the field output value in splunk. below is the screen short i want to RENAME PPN \| V0.2019 \|24... by hrs2019 Path Finder in Splunk Enterprise Security 01-14-2020 0 4	0	4