Splunk Enterprise Security

Community Activity

How to compare 2 lists from 2 different searches ? I have 2 different searches to create 2 hosts list, and I want below from splunk search: 1. Find all hosts from 1st s... by utk123 Path Finder in Splunk Enterprise Security 10-09-2019 0 2	0	2
How to deploy SPL Splunk image on Linux Dear all, I have downloaded SPL tared image at https://splunkbase.splunk.com/app/4516/ and I want to deploy it Linux... by andykrnac New Member in Splunk Enterprise Security 10-09-2019 0 3	0	3
SSL Medium Strength Cipher Suites Supported (SWEET32) and SSL RC4 Cipher Suites Supported (Bar Mitzvah) {CVE-2016-2183 , CVE-2013-2566,CVE-2015-2808} We have received notice that our splunk heavy forwarder is vulnerable to CVE-2016-2183 , CVE-2013-2566,CVE-2015-2808.... by ss656204 New Member in Splunk Enterprise Security 10-09-2019 0 0	0	0
Adding an Azure sign in field to Splunk ES authentication data model We recently started to ingest Microsoft's Azure sign-in events and one thing I've noticed are some values from the cl... by jwalzerpitt Influencer in Splunk Enterprise Security 10-09-2019 0 0	0	0
Getting started with BOTS 2.0 - need help Hello Everyone I am curious to learn with BOTS 2.0 but need some help. I have downloaded BOTS 2.0 but unable to fin... by cyber4good Engager in Splunk Enterprise Security 10-09-2019 1 2	1	2
How to alert when a rogue/unknown device is plugged into network Hi, I need to be alerted when a rogue/unknown device is plugged into network. Any help will be appreciated. by pradeep577 Path Finder in Splunk Enterprise Security 10-08-2019 0 2	0	2
Defining Authorized Name Servers in ES The ES correlation search 'DNS Query Requests Resolved by Unauthorized DNS Servers' determines if the traffic is to f... by barcher83 Explorer in Splunk Enterprise Security 10-07-2019 0 2	0	2
What parts of the Enterprise Security dashboard are displayed the output related to this Add-on ? Hi Dear Friends, I installed "Splunk Add-on for Unix and Linux" and now i have a question What parts of the Enterpris... by hamzeh_khosravi New Member in Splunk Enterprise Security 10-07-2019 0 0	0	0
Salesforce marketing cloud integration with Splunk Hello experts, I am trying to integration salesforce cloud modules into splunk for security monitoring. Does anyne ha... by bbiswabhusan Explorer in Splunk Enterprise Security 10-07-2019 0 1	0	1
How to get the difference in count of users and then trigger an alert Hi Everyone, I have a splunk search: Search: sourcetype = onelogin:event index = onelogin earliest=-12d AND event_ty... by shubham1234 New Member in Splunk Enterprise Security 10-05-2019 0 3	0	3
Splunk Enterprise security search head is not pulling logs from firewall, waf,proxy logs, MFA, sandbox, ...network resources but my other search head for apps is getting all data Splunk Enterprise security search head is not pulling logs from firewall, waf,proxy logs, MFA, sandbox, ...network r... by RK_sp1unk New Member in Splunk Enterprise Security 10-02-2019 0 0	0	0
DNS query in threat intelligence of Enterprise Security Hi, Configured the proxy for retrieving threat intelligence in Enterprise Security and its succesfully retrieved th... by rossikwan Path Finder in Splunk Enterprise Security 10-02-2019 0 1	0	1
SavedSearch running as type=Inline works, type=Saved fails - why? I setup a saved search and it is failing to run. It is throwing an error in the gui Error in 'sendalert' command: Al... by bowesmana SplunkTrust in Splunk Enterprise Security 10-01-2019 0 1	0	1
How to add a chart that shows the average vulnerabilities per host grouped by Service Hi, I created a vulnerability dashboard that looks like this: VulnerabilityId, Host, Service 123, HostA, Mail 234, ... by gbhw New Member in Splunk Enterprise Security 10-01-2019 0 1	0	1
Downloaded an old snapshot created 485320 seconds ago As part of the destructive resync that I performed on the 2 members that were out of sync, I saw the below messages o... by sylim_splunk Splunk Employee in Splunk Enterprise Security 10-01-2019 0 1	0	1
Prerequisites for Administering ES 5.2 The prerequisites for Administering ES 5.2 are vague. Is the prerequisite completing the two courses Splunk System A... by hugovaughan New Member in Splunk Enterprise Security 10-01-2019 0 1	0	1
Network Glass table Hello Team, Please we need to create a Network Glass Table depending with our devices that sending data to splunk (... by sec_team_albara New Member in Splunk Enterprise Security 10-01-2019 0 0	0	0
How do I use an eval where the final value is pulled out of a lookup file? How do I use an eval where the final value is pulled out of a lookup file.? Trying to use the following but cant get... by jacqu3sy Path Finder in Splunk Enterprise Security 10-01-2019 0 2	0	2
Datamodel Child object not accelerated We created a child object within the authentication datamodel. The authentication datamodel is accelerated, when sear... by MattibergB Path Finder in Splunk Enterprise Security 09-30-2019 0 0	0	0
Assign Risk in Correlation Search We are trying to integrate the risk analysis framework in our incident response process. We have developed a libra... by panovattack Communicator in Splunk Enterprise Security 09-30-2019 0 6	0	6
How to tune the Splunk App for Enterprise Security to prevent our web logs from being triggered as Personally Identifiable Information Detection? Hi Everyone, I am still learning Splunk and Enterprise Security and I am working on a problem with Splunk App for En... by infosecdb Engager in Splunk Enterprise Security 09-29-2019 1 2	1	2
Extracting Next Steps in Splunk ES Notables Hey All, I am still new to Splunk so apology for my ignorance, is there a way to extract "Next Steps" under Adaptive... by vthao New Member in Splunk Enterprise Security 09-28-2019 0 0	0	0
Splunkbase Add on ServiceNow When trying to connect the "Splunk Add-on for ServiceNow" I am not able to connect to the ServiceNow instance. ERRO... by pslattery23 New Member in Splunk Enterprise Security 09-27-2019 0 7	0	7
Enterprise Security: Why ES Content Updates doesn’t show the Analytic Stories? Something looks fishy with this app. No Analytic Stories are available in the app. What should we do? by danielbb Motivator in Splunk Enterprise Security 09-27-2019 0 3	0	3
"Concurrent Login Attempts Detected" CS results have hostnames and IPs showing as previous_src and src We're getting false positives on the correlated search, "Concurrent Login Attempts Detected", because the previous_sr... by wgawhh5hbnht Communicator in Splunk Enterprise Security 09-27-2019 0 1	0	1