Splunk Enterprise Security

Community Activity

streams and DNS over (HTTPS or TLS)...DoH/DoT How will Splunk address encrypted DNS collection? It's weird you need to have karma points to post a link, look up t... by cpnewton Explorer in Splunk Enterprise Security 07-02-2019 1 3	1	3
Detecting Port Scan (nmap) I did a test port scan using nmap. This way I could catch what I was looking for in ES. Below is my query and it show... by siddh01r New Member in Splunk Enterprise Security 07-02-2019 0 0	0	0
crcSalt is not working with multiple sub dir contains same file name monitoring Hi, Am writing a monitoring stanza to on-board the files with same name but different sub-directory named using fol... by vemurisurya Path Finder in Splunk Enterprise Security 07-02-2019 0 1	0	1
Threat Intelligence Searches Not Populating threat_activity Index The search "Threat - Source and Destination Matches - Threat Gen" is working and producing results, only the results ... by joeldavideng Path Finder in Splunk Enterprise Security 07-02-2019 0 0	0	0
How can I filter incoming traffic from outgoing traffic Hi I am working on a DDoS alert. I want to detect spikes of incoming traffic. But I am not sure on how to different... by rosho Communicator in Splunk Enterprise Security 07-02-2019 0 1	0	1
Differences between the Splunk Security courses? Could anyone give me a synopsis of the differences between the courses "Using Splunk Enterprise Security 5.2" and "Ad... by thebaconking Explorer in Splunk Enterprise Security 07-01-2019 0 4	0	4
Splunk Enterprise Security: How to join with lookup I need to cross the information of my lookup with fields from my index, and bring some information on the table, but ... by leticiamartello New Member in Splunk Enterprise Security 07-01-2019 0 1	0	1
Is there a page view that shows all Source's for an Index Aside from doing a search is there a configuration page that will show me all the sources sending logs to an index at... by gregoryrecords Engager in Splunk Enterprise Security 07-01-2019 0 5	0	5
Login for Splunk Security Datasets project Hi, I registered to access the Splunk Security Datasets project and received an email with a link to login, but the ... by a212830 Champion in Splunk Enterprise Security 07-01-2019 0 3	0	3
Splunk Enterprise Security: How to associate business software to an asset? I have a .csv which contains a list of business applications, the app owner, the server(hostname or same as nt_host) ... by edhealea Path Finder in Splunk Enterprise Security 06-29-2019 0 1	0	1
Old Notable event marked as unassigned. We pushed the new app out on ES cluster. After the app push, old notable events are showing up as "assigned" and our ... by rbal_splunk Splunk Employee in Splunk Enterprise Security 06-27-2019 0 1	0	1
Forescout implementation 2.8 with Splunk 6.5.3 Please refer the below details and provide me support for effective resolution : Facing issues while implementing fo... by Riasudin New Member in Splunk Enterprise Security 06-26-2019 0 2	0	2
Looking for .conf17 FFIEC Cat initiative paper Hello! I attended a session at .conf2017 entitled "FFIEC Cybersecurity Assessment Tool". In the presentation Curtis... by jensterddcaa New Member in Splunk Enterprise Security 06-25-2019 0 3	0	3
oplogSize default value control I am working with ES Splunk & want to increase the oplogSize from 1Gig to 2Gig.. From KVStore hammer .conf talk:... by stanwin Contributor in Splunk Enterprise Security 06-25-2019 0 1	0	1
Why is Splunk ES Contributing Events not seeing many incidents? Hi splunkers, My question is Why I not see Contributing Events in All incidents ? I want to go directly to the ev... by burakatabay Path Finder in Splunk Enterprise Security 06-25-2019 0 3	0	3
How to create a search condition in Splunk where an alert is based on result? I want to get alerts for the situations which are different from below conditions: Server a B C D condition ... by ruchijain New Member in Splunk Enterprise Security 06-25-2019 0 3	0	3
Splunk Enterprise Security: How to route data into app Hi, I can't find any material for studying Splunk security essential app, is there any documentation or videos explai... by ahmedragy922 Explorer in Splunk Enterprise Security 06-24-2019 0 1	0	1
How to black list all the ports except the approved ports using interesting ports list in splunk enterprise security? I would like to black list (get alert) for all the ports excepting the approved port list using interesting port list... by prammod123 Explorer in Splunk Enterprise Security 06-24-2019 0 3	0	3
How to exclude IPs from results while using Tstats and a sourcetype that is not the same? Current search is essentially this: \| tstats values(All_Traffic.src) as src from datamodel=Network_Traffic.All_T... by aminfosec New Member in Splunk Enterprise Security 06-23-2019 0 5	0	5
Splunk Enterprise Security: Where to learn SPL, searches, and log sources? Hi everyone, I need to learn SPL searches quickly. In particular, I need to focus on covering the log source (CWS, ... by dzejsonborn New Member in Splunk Enterprise Security 06-21-2019 0 1	0	1
Splunk Add-on for Microsoft Cloud Services: action="Unknown" The Splunk Add-on for Microsoft Cloud Services is populating the Authentication datamodel in ES, however action="Unkn... by barcher83 Explorer in Splunk Enterprise Security 06-21-2019 0 2	0	2
Splunk Enterprise Security: How to secure part of the _audit index? We have Enterprise Security installed for a specific Search Head and would like the _audit logs in a different locati... by tjago11 Communicator in Splunk Enterprise Security 06-21-2019 0 4	0	4
How to use tstats command with datamodel and like function How to use tstats command with like function. Ex: \| tstats count(eval(Authentication.action, "failure%")) as failure... by N92 Path Finder in Splunk Enterprise Security 06-20-2019 0 1	0	1
How to invoke adhoc queries After installing and configuring this application I am unable to get the adaptive response to run. I continue to get ... by pcyr Engager in Splunk Enterprise Security 06-19-2019 0 1	0	1
Splunk ESM - The contributing events drill-down search is not the same as my correlation rules "Notable action" drill-down search I've changed an existing correlation search and it's drill-down in the adaptive response actions, but when the notabl... by Rajesann New Member in Splunk Enterprise Security 06-18-2019 0 0	0	0