Splunk Enterprise Security

Community Activity

Splunk 6.5.1 and Splunk Enterprise Security 4.5.1: What is upgrade path from Splunk 6.4.0 and ES 4.1.1? Hi, I know the order to upgrade Splunk components. But don't totally understand the path to upgrade from Splunk Ente... by brdr Contributor in Splunk Enterprise Security 07-08-2019 0 3	0	3
Phantom - Assign Container/Case to Self - Playbook I am working on automating some minor things and I want to add in a step to have the playbook assign the container or... by jamolson Path Finder in Splunk Enterprise Security 07-08-2019 0 2	0	2
web security logs (raw data) Hello everyone, Urgently, am looking for a web security logs to ingest it in splunk enterprise for practicing purpo... by mkhedr Explorer in Splunk Enterprise Security 07-07-2019 0 1	0	1
ES: Why does my new search not appear in the "Saved Search Name" on the "Incident Review" screen? I created a new correlation search like I have many times before but this time when it fires on the Security Posture ... by woodcock Esteemed Legend in Splunk Enterprise Security 07-05-2019 0 1	0	1
I would like to find out failed login attempts with Event Code (4625) here the condition is failed login attempts with in one hour and if the failed attempts less than that what ever the event code present in the index will be displayed.? Hi All, I would like to find out failed login attempts with Event Code (4625) , here the condition is failed login a... by 90509 Engager in Splunk Enterprise Security 07-03-2019 0 8	0	8
How to get word on search and save on new column tables ? Hello guys, I have a search, sourcetype=example "testword" OR "abcd" \| table _time _raw If I run this query, I... by nisnes12 New Member in Splunk Enterprise Security 07-03-2019 0 7	0	7
Help with Splunk ES Investigations Collaborators Hello, We are using Splunk Enterprise Security and I was just wondering if there is any way to add multiple collabor... by mbouchersops Engager in Splunk Enterprise Security 07-02-2019 2 1	2	1
streams and DNS over (HTTPS or TLS)...DoH/DoT How will Splunk address encrypted DNS collection? It's weird you need to have karma points to post a link, look up t... by cpnewton Explorer in Splunk Enterprise Security 07-02-2019 1 3	1	3
Detecting Port Scan (nmap) I did a test port scan using nmap. This way I could catch what I was looking for in ES. Below is my query and it show... by siddh01r New Member in Splunk Enterprise Security 07-02-2019 0 0	0	0
crcSalt is not working with multiple sub dir contains same file name monitoring Hi, Am writing a monitoring stanza to on-board the files with same name but different sub-directory named using fol... by vemurisurya Path Finder in Splunk Enterprise Security 07-02-2019 0 1	0	1
Threat Intelligence Searches Not Populating threat_activity Index The search "Threat - Source and Destination Matches - Threat Gen" is working and producing results, only the results ... by joeldavideng Path Finder in Splunk Enterprise Security 07-02-2019 0 0	0	0
How can I filter incoming traffic from outgoing traffic Hi I am working on a DDoS alert. I want to detect spikes of incoming traffic. But I am not sure on how to different... by rosho Communicator in Splunk Enterprise Security 07-02-2019 0 1	0	1
Differences between the Splunk Security courses? Could anyone give me a synopsis of the differences between the courses "Using Splunk Enterprise Security 5.2" and "Ad... by thebaconking Explorer in Splunk Enterprise Security 07-01-2019 0 4	0	4
Splunk Enterprise Security: How to join with lookup I need to cross the information of my lookup with fields from my index, and bring some information on the table, but ... by leticiamartello New Member in Splunk Enterprise Security 07-01-2019 0 1	0	1
Is there a page view that shows all Source's for an Index Aside from doing a search is there a configuration page that will show me all the sources sending logs to an index at... by gregoryrecords Engager in Splunk Enterprise Security 07-01-2019 0 5	0	5
Login for Splunk Security Datasets project Hi, I registered to access the Splunk Security Datasets project and received an email with a link to login, but the ... by a212830 Champion in Splunk Enterprise Security 07-01-2019 0 3	0	3
Splunk Enterprise Security: How to associate business software to an asset? I have a .csv which contains a list of business applications, the app owner, the server(hostname or same as nt_host) ... by edhealea Path Finder in Splunk Enterprise Security 06-29-2019 0 1	0	1
Old Notable event marked as unassigned. We pushed the new app out on ES cluster. After the app push, old notable events are showing up as "assigned" and our ... by rbal_splunk Splunk Employee in Splunk Enterprise Security 06-27-2019 0 1	0	1
Forescout implementation 2.8 with Splunk 6.5.3 Please refer the below details and provide me support for effective resolution : Facing issues while implementing fo... by Riasudin New Member in Splunk Enterprise Security 06-26-2019 0 2	0	2
Looking for .conf17 FFIEC Cat initiative paper Hello! I attended a session at .conf2017 entitled "FFIEC Cybersecurity Assessment Tool". In the presentation Curtis... by jensterddcaa New Member in Splunk Enterprise Security 06-25-2019 0 3	0	3
oplogSize default value control I am working with ES Splunk & want to increase the oplogSize from 1Gig to 2Gig.. From KVStore hammer .conf talk:... by stanwin Contributor in Splunk Enterprise Security 06-25-2019 0 1	0	1
Why is Splunk ES Contributing Events not seeing many incidents? Hi splunkers, My question is Why I not see Contributing Events in All incidents ? I want to go directly to the ev... by burakatabay Path Finder in Splunk Enterprise Security 06-25-2019 0 3	0	3
How to create a search condition in Splunk where an alert is based on result? I want to get alerts for the situations which are different from below conditions: Server a B C D condition ... by ruchijain New Member in Splunk Enterprise Security 06-25-2019 0 3	0	3
Splunk Enterprise Security: How to route data into app Hi, I can't find any material for studying Splunk security essential app, is there any documentation or videos explai... by ahmedragy922 Explorer in Splunk Enterprise Security 06-24-2019 0 1	0	1
How to black list all the ports except the approved ports using interesting ports list in splunk enterprise security? I would like to black list (get alert) for all the ports excepting the approved port list using interesting port list... by prammod123 Explorer in Splunk Enterprise Security 06-24-2019 0 3	0	3