Splunk Enterprise Security

Community Activity

Adaptive response actions wont show up We have created a large amount of custom Adaptive response actions that primarily consist of actions that fetch infor... by reubenjoseph Explorer in Splunk Enterprise Security 09-09-2019 0 6	0	6
Health Check: msg="A script exited abnormally with exit status: 4" From the Monitoring Console: Health Check: msg="A script exited abnormally with exit status: 4" input="./opt/splunk... by dillardo_2 Path Finder in Splunk Enterprise Security 09-09-2019 0 3	0	3
Comparing results from two searches index="A" sourcetype=B action=Yes \| search NOT [ search index="A" sourcetype=B action="No" \| fields User ] \| stats co... by rupeshn Explorer in Splunk Enterprise Security 09-09-2019 1 11	1	11
Use Monitoring Console to monitor a Search Head with Enterprise Security Hi at all, I have the following architecture: 2 clustered Indexers,2 Search Heads,1 Master Node,1 Deployment Server.... by gcusello SplunkTrust in Splunk Enterprise Security 09-09-2019 0 5	0	5
How to create a correlation search from a threat intelligence feed I wanted to take malicious IP's/URL's that the threat Intel feeds provides and compare them against logs/traffic we s... by smote01 New Member in Splunk Enterprise Security 09-05-2019 0 0	0	0
New Security Domain I want to add a new Security Domain called "Email" in Enterprise Security (ES) App and later map it to notables. Righ... by shrutheen Explorer in Splunk Enterprise Security 09-05-2019 1 1	1	1
ES Upgrade 4.7.1 to 5.2.0 (customized .xml, .json files functionality) Hi Team, We are performing Splunk ES upgrade from 4.7.1 to 5.2.0. Post upgrade, I have few .xml, .json files that ne... by santosh_scb Path Finder in Splunk Enterprise Security 09-04-2019 0 2	0	2
Custom Alerts in SPLUNK Enterprise We have recently installed Enterprise Security and have enabled a few use cases. This was done with the guidance of ... by willadams Contributor in Splunk Enterprise Security 09-04-2019 0 2	0	2
[ES Managed Lookup] error: "An error occurred" in popup window when clicking "Stop managing" When creating a managed lookup and the destination app is chosen to be a custom app we made (that ES inherits), it cr... by sylim_splunk Splunk Employee in Splunk Enterprise Security 09-04-2019 1 1	1	1
How do I determine why a Correlation Search isn't creating a notable event when I expected one? I have a Correlation Search that didn't generate notable events in a couple where I think it should have. How can I d... by LukeMurphey Champion in Splunk Enterprise Security 09-04-2019 1 4	1	4
Splunk Enterprise Security: How to exclude indexes from Authentication Data Model How to exclude some indexes from authentication data model? We have some indexes such as lastchanceindex, but eventty... by lucas4394 Path Finder in Splunk Enterprise Security 09-03-2019 0 4	0	4
Searching notable events in ES to match user field Folks, I'm trying to match a field (user) from a search to see if any previous notable events ES have been generated ... by marktechuk New Member in Splunk Enterprise Security 09-03-2019 0 2	0	2
Linux encryption We're looking into full disk encryption and was looking in Linux full disk encryption. Any concerns you can think of... by ritchiem14 New Member in Splunk Enterprise Security 09-03-2019 0 1	0	1
Enterprise Security: How can I trace the notable events? I created a correlation search that should have produced notable events. How can I trace these notable events? by danielbb Motivator in Splunk Enterprise Security 09-03-2019 0 19	0	19
We are attempting to setup local lookup file as a threat intelligence download ( as per https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Addthreatintelcustomlookup) . and are unable to use th... by rbal_splunk Splunk Employee in Splunk Enterprise Security 08-30-2019 0 2	0	2
Problem on Changing Syslog Sourcetype The problem is on changing syslog sourcetype into another one. I read all splunk answer about it. I am following the ... by element1314 New Member in Splunk Enterprise Security 08-29-2019 0 1	0	1
How to track inbound and outbound traffic from firewall logs Hi helpful people, I am trying to create a use case which will monitor source and destination traffic(like both comm... by ashferns08 Engager in Splunk Enterprise Security 08-29-2019 0 3	0	3
add variables into serach name under correlation search can we add certain variables like $src$ \| $dest$ into search name: actually we are sending... by riqbal47010 Path Finder in Splunk Enterprise Security 08-29-2019 0 1	0	1
Help with regex to print the value Total_bytes_recv and Total_bytes_send from log Log: Aug 28 17:46:20 192.168.111.14 08/28/2019:16:46:18 GMT 0-PPE-0 : default TCP OTHERCONN_DELINK 1091143 0 : Sourc... by sarbankumar New Member in Splunk Enterprise Security 08-29-2019 0 6	0	6
How to get correlation searches to trigger on older data? We had an incident on a device that we had not had a chance to ingest logs into Splunk. That incident occurred 2 week... by nb1030 New Member in Splunk Enterprise Security 08-28-2019 0 3	0	3
How do I merge two searches into one, and have all the fields filled in? I have two seperate searches that I appended together, but I only need one field out of the second search. My proble... by ESPrioleau New Member in Splunk Enterprise Security 08-28-2019 0 2	0	2
How can end user help improve overall Splunk Enterprise Security speed? My Splunk Admin is the landlord and I'm the tenant. Let's say the landlord is dealing with personal matters and canno... by jsven7 Communicator in Splunk Enterprise Security 08-28-2019 0 2	0	2
Datamodel status building since long I have Email datamodel that ships alongwith Splunk ES. It's in building status and it's accelerated too. How to trou... by snigdhasaxena Communicator in Splunk Enterprise Security 08-26-2019 0 3	0	3
How to Add Workflow Search Action under notable event From a Splunk custom App, I need to add the workflow action which should be displayed under the Actions menu for the ... by gsabhay77 Explorer in Splunk Enterprise Security 08-26-2019 0 2	0	2
Difference between Palo alto all indecent and ES notable events? Hi Splunkers, We are getting critical incidents in Palo alto All incidents dashboard. We configured ES threat activ... by p_gurav Champion in Splunk Enterprise Security 08-26-2019 0 1	0	1