Splunk Enterprise Security

Community Activity

How to get the difference in count of users and then trigger an alert Hi Everyone, I have a splunk search: Search: sourcetype = onelogin:event index = onelogin earliest=-12d AND event_ty... by shubham1234 New Member in Splunk Enterprise Security 10-05-2019 0 3	0	3
Splunk Enterprise security search head is not pulling logs from firewall, waf,proxy logs, MFA, sandbox, ...network resources but my other search head for apps is getting all data Splunk Enterprise security search head is not pulling logs from firewall, waf,proxy logs, MFA, sandbox, ...network r... by RK_sp1unk New Member in Splunk Enterprise Security 10-02-2019 0 0	0	0
DNS query in threat intelligence of Enterprise Security Hi, Configured the proxy for retrieving threat intelligence in Enterprise Security and its succesfully retrieved th... by rossikwan Path Finder in Splunk Enterprise Security 10-02-2019 0 1	0	1
SavedSearch running as type=Inline works, type=Saved fails - why? I setup a saved search and it is failing to run. It is throwing an error in the gui Error in 'sendalert' command: Al... by bowesmana SplunkTrust in Splunk Enterprise Security 10-01-2019 0 1	0	1
How to add a chart that shows the average vulnerabilities per host grouped by Service Hi, I created a vulnerability dashboard that looks like this: VulnerabilityId, Host, Service 123, HostA, Mail 234, ... by gbhw New Member in Splunk Enterprise Security 10-01-2019 0 1	0	1
Downloaded an old snapshot created 485320 seconds ago As part of the destructive resync that I performed on the 2 members that were out of sync, I saw the below messages o... by sylim_splunk Splunk Employee in Splunk Enterprise Security 10-01-2019 0 1	0	1
Prerequisites for Administering ES 5.2 The prerequisites for Administering ES 5.2 are vague. Is the prerequisite completing the two courses Splunk System A... by hugovaughan New Member in Splunk Enterprise Security 10-01-2019 0 1	0	1
Network Glass table Hello Team, Please we need to create a Network Glass Table depending with our devices that sending data to splunk (... by sec_team_albara New Member in Splunk Enterprise Security 10-01-2019 0 0	0	0
How do I use an eval where the final value is pulled out of a lookup file? How do I use an eval where the final value is pulled out of a lookup file.? Trying to use the following but cant get... by jacqu3sy Path Finder in Splunk Enterprise Security 10-01-2019 0 2	0	2
Datamodel Child object not accelerated We created a child object within the authentication datamodel. The authentication datamodel is accelerated, when sear... by MattibergB Path Finder in Splunk Enterprise Security 09-30-2019 0 0	0	0
Assign Risk in Correlation Search We are trying to integrate the risk analysis framework in our incident response process. We have developed a libra... by panovattack Communicator in Splunk Enterprise Security 09-30-2019 0 6	0	6
How to tune the Splunk App for Enterprise Security to prevent our web logs from being triggered as Personally Identifiable Information Detection? Hi Everyone, I am still learning Splunk and Enterprise Security and I am working on a problem with Splunk App for En... by infosecdb Engager in Splunk Enterprise Security 09-29-2019 1 2	1	2
Extracting Next Steps in Splunk ES Notables Hey All, I am still new to Splunk so apology for my ignorance, is there a way to extract "Next Steps" under Adaptive... by vthao New Member in Splunk Enterprise Security 09-28-2019 0 0	0	0
Splunkbase Add on ServiceNow When trying to connect the "Splunk Add-on for ServiceNow" I am not able to connect to the ServiceNow instance. ERRO... by pslattery23 New Member in Splunk Enterprise Security 09-27-2019 0 7	0	7
Enterprise Security: Why ES Content Updates doesn’t show the Analytic Stories? Something looks fishy with this app. No Analytic Stories are available in the app. What should we do? by danielbb Motivator in Splunk Enterprise Security 09-27-2019 0 3	0	3
"Concurrent Login Attempts Detected" CS results have hostnames and IPs showing as previous_src and src We're getting false positives on the correlated search, "Concurrent Login Attempts Detected", because the previous_sr... by wgawhh5hbnht Communicator in Splunk Enterprise Security 09-27-2019 0 1	0	1
script (.bat) only outputs the first 9 lines - manually running command outputs 70+ I'm attempting to get DHCP lease info and as far as I can tell I need write a script to get this info (please let me ... by wgawhh5hbnht Communicator in Splunk Enterprise Security 09-26-2019 0 8	0	8
WARN UserManagerPro - Can't find [distributedSearch] stanza in distsearch.conf, using default authtoken HTTP timeouts I am getting this message in Splunkd.log on a universal forwarder version 6.5.2. There is no such file called distse... by damode Motivator in Splunk Enterprise Security 09-25-2019 0 0	0	0
Splunk_TA_mimecast_for_splunk_v2-2.0.1 having error while pulling the data from mimecast. - Error -Unexpected error getting raw log data Incorrect padding I am getting below error after integrating the mimcast app. Please help. 2018-05-20 22:30:22.569 INFO message fr... by vinay_kadagave Explorer in Splunk Enterprise Security 09-25-2019 0 1	0	1
Splunk Rules: How to suppress threat activity alert into one Hello Dears, We usually see the threat correlation alert suppressed basis on the filed specified as per snap attache... by pavanbmishra Path Finder in Splunk Enterprise Security 09-25-2019 0 0	0	0
Splunk Enterprise Security Online Sandbox Started a trial ES sandbox (20-09-2019). Got a link. Everything was working properly till today. License is blocking ... by adamguzek Explorer in Splunk Enterprise Security 09-25-2019 0 0	0	0
how to integrate with splunk and alienvault ? AlienVault Ossim App by A3SEC i just install the app and follow the document but i didnt get the dashboard same as al... by zippyopsadmin New Member in Splunk Enterprise Security 09-25-2019 0 2	0	2
Does Splunk 7.2 support Onapsis for SAP integration Hi All, Hope you are doing well. I have requirement to integrate Onapsis for SAP with Splunk. As per app document ... by bhsakarchourasi Path Finder in Splunk Enterprise Security 09-25-2019 0 0	0	0
Null value for urgency in incident_review lookup Hi Splunkers, when we save\close notable events without changing the Urgency we get no any value (null) for urgency ... by evelenke Contributor in Splunk Enterprise Security 09-24-2019 0 1	0	1
Splunk Enterprise Security: Dashboards not loading data We have a indexer , heavy forwarder, 2 search head , 1 deployment server . The splunk enterprise Search head dashboar... by RK_sp1unk New Member in Splunk Enterprise Security 09-24-2019 0 0	0	0