Splunk Enterprise Security

Community Activity

Enterprise Security : Is there a demo/video of the Incident Review section? The team here is not satisfied with the capabilities, workflow of the Incident Review section of ES. Is there a nice ... by danielbb Motivator in Splunk Enterprise Security 10-15-2019 0 1	0	1
splunk Enterprise security I created few correlation searches notable events in Enterprise security and in Incident Review - Table Attributes I... by vikram1583 Explorer in Splunk Enterprise Security 10-15-2019 0 1	0	1
retrieve the messages from the banner at the top of the UI and create a Dasboard Hi All, Request you to post the query for retrieving messages displayed on the top of the UI so that a Dashboard/rep... by samadmemon Explorer in Splunk Enterprise Security 10-15-2019 0 1	0	1
Enterprise Security: How do we enable automatic updates by the ESCU? We are wondering how to enable the automatic updates by the ESCU. We have it working fine but it doesn't seem to fetc... by danielbb Motivator in Splunk Enterprise Security 10-15-2019 0 5	0	5
Enterprise Security: why is the src_user a recommended field for the Authentication datamodel? src_user shows only 5 or so of percent_coverage in the cim_validator for our Windows data. Fields for Authentication... by danielbb Motivator in Splunk Enterprise Security 10-15-2019 0 4	0	4
Splunk nobody user vs Service User Hi All, We have an environment where the owner of all the Dashboards/Alerts is user 'nobody'. Are there any disadvan... by samadmemon Explorer in Splunk Enterprise Security 10-15-2019 0 0	0	0
Fail on start splunk after the upgrade of Splunk Enterprise Security from v4.7.0 to 5.3.1. After upgrade to Splunk Enterprise Security v 5.3.1, fail on startup with the following error: [root@splunk02 bin]# ... by splunkbeginner Engager in Splunk Enterprise Security 10-15-2019 0 1	0	1
Kaspersky security center mapping to Enterprise Security I've recently indexed kaspersky security center 10 data in splunk, but malware center in enterprise security showed n... by abwe Loves-to-Learn Lots in Splunk Enterprise Security 10-14-2019 0 3	0	3
SPL for Correlation search in enterprise security? index=email \| transaction mid icid \| stats count(recipient) as receipent_count by sender \| where receipent_count>1... by vikram1583 Explorer in Splunk Enterprise Security 10-13-2019 0 2	0	2
Rename existing correlation search Title Hi Fellows, I need to change the title of existing correlation search which I am not able to do as the options are g... by Arpmjdr Explorer in Splunk Enterprise Security 10-13-2019 1 3	1	3
Problem with threat notables on Splunk ES Hello , We have a Splunk ES 5.1.0 application installed on Splunk Entreprise version 7.2.0. We need to collect the... by aalaa Path Finder in Splunk Enterprise Security 10-11-2019 0 0	0	0
MLTK: Does it support multi-output classification? Does the MLTK support multi-output classification, i.e., more than 1 predicted field? Thank you. by danman81 Engager in Splunk Enterprise Security 10-10-2019 0 4	0	4
How to compare 2 lists from 2 different searches ? I have 2 different searches to create 2 hosts list, and I want below from splunk search: 1. Find all hosts from 1st s... by utk123 Path Finder in Splunk Enterprise Security 10-09-2019 0 2	0	2
How to deploy SPL Splunk image on Linux Dear all, I have downloaded SPL tared image at https://splunkbase.splunk.com/app/4516/ and I want to deploy it Linux... by andykrnac New Member in Splunk Enterprise Security 10-09-2019 0 3	0	3
SSL Medium Strength Cipher Suites Supported (SWEET32) and SSL RC4 Cipher Suites Supported (Bar Mitzvah) {CVE-2016-2183 , CVE-2013-2566,CVE-2015-2808} We have received notice that our splunk heavy forwarder is vulnerable to CVE-2016-2183 , CVE-2013-2566,CVE-2015-2808.... by ss656204 New Member in Splunk Enterprise Security 10-09-2019 0 0	0	0
Adding an Azure sign in field to Splunk ES authentication data model We recently started to ingest Microsoft's Azure sign-in events and one thing I've noticed are some values from the cl... by jwalzerpitt Influencer in Splunk Enterprise Security 10-09-2019 0 0	0	0
Getting started with BOTS 2.0 - need help Hello Everyone I am curious to learn with BOTS 2.0 but need some help. I have downloaded BOTS 2.0 but unable to fin... by cyber4good Engager in Splunk Enterprise Security 10-09-2019 1 2	1	2
How to alert when a rogue/unknown device is plugged into network Hi, I need to be alerted when a rogue/unknown device is plugged into network. Any help will be appreciated. by pradeep577 Path Finder in Splunk Enterprise Security 10-08-2019 0 2	0	2
Defining Authorized Name Servers in ES The ES correlation search 'DNS Query Requests Resolved by Unauthorized DNS Servers' determines if the traffic is to f... by barcher83 Explorer in Splunk Enterprise Security 10-07-2019 0 2	0	2
What parts of the Enterprise Security dashboard are displayed the output related to this Add-on ? Hi Dear Friends, I installed "Splunk Add-on for Unix and Linux" and now i have a question What parts of the Enterpris... by hamzeh_khosravi New Member in Splunk Enterprise Security 10-07-2019 0 0	0	0
Salesforce marketing cloud integration with Splunk Hello experts, I am trying to integration salesforce cloud modules into splunk for security monitoring. Does anyne ha... by bbiswabhusan Explorer in Splunk Enterprise Security 10-07-2019 0 1	0	1
How to get the difference in count of users and then trigger an alert Hi Everyone, I have a splunk search: Search: sourcetype = onelogin:event index = onelogin earliest=-12d AND event_ty... by shubham1234 New Member in Splunk Enterprise Security 10-05-2019 0 3	0	3
Splunk Enterprise security search head is not pulling logs from firewall, waf,proxy logs, MFA, sandbox, ...network resources but my other search head for apps is getting all data Splunk Enterprise security search head is not pulling logs from firewall, waf,proxy logs, MFA, sandbox, ...network r... by RK_sp1unk New Member in Splunk Enterprise Security 10-02-2019 0 0	0	0
DNS query in threat intelligence of Enterprise Security Hi, Configured the proxy for retrieving threat intelligence in Enterprise Security and its succesfully retrieved th... by rossikwan Path Finder in Splunk Enterprise Security 10-02-2019 0 1	0	1
SavedSearch running as type=Inline works, type=Saved fails - why? I setup a saved search and it is failing to run. It is throwing an error in the gui Error in 'sendalert' command: Al... by bowesmana SplunkTrust in Splunk Enterprise Security 10-01-2019 0 1	0	1