Splunk Enterprise Security

Community Activity

No Notables created but correlation searches are working manually till few afters before all my notables were working properly. I made changes in XML file of default.xml on navigation... by saurabhsumangat New Member in Splunk Enterprise Security 04-25-2019 0 2	0	2
Adding an ID number to ES investigations Is there a way to automagically add a unique ID number to each investigation that is opened? by bcyates Communicator in Splunk Enterprise Security 04-25-2019 0 2	0	2
How to add a view to Enterprise Security? I am trying to add a view to Enterprise Security by going to Configure > General > Navigation. Here I am able to crea... by wendtb Path Finder in Splunk Enterprise Security 04-25-2019 0 1	0	1
Can someone help me understand this event from Splunk ES ? I have these events on Splunk ES security posture dashboard and need help in understand how the detection for this on... by hrithiktej Communicator in Splunk Enterprise Security 04-25-2019 0 3	0	3
How to set up a custom search/alert to track when Windows event log service start/stop for Windows Server 2008+? Just wanted to put this out there to the universe... Has anyone set up a custom search/alert to track when the Window... by metalgear138 Engager in Splunk Enterprise Security 04-25-2019 0 5	0	5
XML Error - Read Timeout while accessing SPLUNK on browser I have recently modified my navigation menu XML through splunk user interface. Now when i refresh the splunk instanc... by saurabhsumangat New Member in Splunk Enterprise Security 04-25-2019 0 0	0	0
dest=unknown in ES We are having an issue with our Splunk ES instance where notables that have dest = unknown, all show up in our ESS In... by richardphung Communicator in Splunk Enterprise Security 04-25-2019 0 2	0	2
add key indicators into custom dashboard how can I add existing key indicator to my new dashboard. I want to add malware key indicator to my custom dashboard... by rashid47010 Communicator in Splunk Enterprise Security 04-25-2019 0 1	0	1
Splunk SIEM Application Hi All, We are using Splunk Enterprise, During server cleaning, We found out that Splunk Enterprise security is als... by rohitvjoshi Path Finder in Splunk Enterprise Security 04-24-2019 0 1	0	1
Keep specific events and discard the rest Hello I want to index the events in the firewalls log based in the alert level and the virtual domain in witch they h... by yosoypako Path Finder in Splunk Enterprise Security 04-24-2019 0 9	0	9
Update default/props.conf with TA-eStreamer Hello @douglashurd - Could you pls review default/props.conf as its reusing same name [FIELDALIAS-eStreamer_category... by lakshman239 Influencer in Splunk Enterprise Security 04-24-2019 0 0	0	0
Threat Intelligence feeds Hi, I upload custom threat intelligence file named customthreat containing file_name, description,url the threat act... by rashid47010 Communicator in Splunk Enterprise Security 04-24-2019 0 1	0	1
Threat intel not being added Ever since the upgrade to ES 5.3.0 the ip_intel lookup doesn't seem to be getting filled anymore and there aren't any... by mmoermans Path Finder in Splunk Enterprise Security 04-24-2019 0 1	0	1
In incident review tab analyst comments getting truncated when we are adding comments to notable it get indexed but some times the comment is getting truncated. by vinayakwagh Explorer in Splunk Enterprise Security 04-23-2019 0 1	0	1
Is there a way to create custom use case categories within ES? Hello, Is there a way to create custom use case categories within the use case library for ES? The out-of-the-box ca... by plimon Explorer in Splunk Enterprise Security 04-23-2019 0 3	0	3
Adding to 'Additional Fields' In Incident Review Hi, I'm trying to see if there's a way to add additional/custom fields in Incident Review. Is there much room for c... by adam_dixon95 Explorer in Splunk Enterprise Security 04-23-2019 0 1	0	1
ES: How to edit "Description" under Incident Review? Hi, My folks from cybersecurity wishes to display the epoch time under Description to human readable time. I can't s... by morethanyell Builder in Splunk Enterprise Security 04-23-2019 0 1	0	1
Splunk ES Adaptive Response Actions not populating. while Editing the correlation search Adaptive Response Actions dropdown is not populating which has notable event act... by vinayakwagh Explorer in Splunk Enterprise Security 04-19-2019 0 0	0	0
ess_admin role issues Hello, I have a splunk cloud managed deployment which has ES installed on it. First thing is that my user has only... by astatrial Contributor in Splunk Enterprise Security 04-18-2019 0 2	0	2
Single value delta in glass tables ES showing up as N/A but drilling down shows results I'm having an issue where building a glass table in ES for a single value delta ad-hoc search is showing up as N/A, b... by rkondeti3 Explorer in Splunk Enterprise Security 04-17-2019 1 5	1	5
How to install UF on servers that installed from an Image server? Hi, We have a Citrix farm used for browsing by our Call center agents. The Terminal servers are reinstalled automat... by yossefn Path Finder in Splunk Enterprise Security 04-17-2019 0 1	0	1
Performaing a secondary search based on the results of the conditional base search when creating custom Dashboards. I have a drop-down menu with all of the rule names that appear in the events. Some of those have been mapped in a loo... by hexerino Explorer in Splunk Enterprise Security 04-17-2019 0 1	0	1
Why does the search specifies a macro 'fidelis_get_xps_event' cannot be found? In our environment we have 3 separate non-distributed search heads and a 3-clustered indexers. When I try running th... by dyeo Engager in Splunk Enterprise Security 04-16-2019 0 7	0	7
Is it possible to optimize hyperparameters in MLTK? Hi I am using MLTK for anomaly detection. So I am benchmarking algorithms. I was wondering if it is possible to opti... by rosho Communicator in Splunk Enterprise Security 04-16-2019 0 1	0	1
Is it possible to count the number of values in a field by another field without stats? I have a search where I am trying to determine if a sender is a threat based on several different events that are add... by brienhawker Explorer in Splunk Enterprise Security 04-13-2019 0 6	0	6