Splunk Enterprise Security

Community Activity

Alert triggering on an entry not in inputlookup file Hello, i have made an alert as follow : [\|inputlookup admin_groups.csv \| table "query" as Group_Name ] \| search Eve... by cnoulin Explorer in Splunk Enterprise Security 02-27-2019 0 8	0	8
How to whitelist events using inputlookup? I am trying to whitelist events from a specific server using IP and hostname. I am running into 2 issues. I have dif... by wendtb Path Finder in Splunk Enterprise Security 02-26-2019 0 5	0	5
Does a license key(or file) is required to “activate” the Splunk ES App? Hi All, Does a license key(or file) is being required to “activate” the Splunk Enterprise Security App? Looking for... by PruthviPGowda New Member in Splunk Enterprise Security 02-26-2019 0 1	0	1
whether a license key is required for the ES app or not? Hello Folks, I have a concern with one of my customer using Splunk Enterprise Security App,they mentioned the don’t ... by impsk New Member in Splunk Enterprise Security 02-26-2019 0 1	0	1
In Splunk Enterprise Security, how do you change a query result when a drop down option is selected within a panel? Hi, I have four options in a drop down--- Highest,Lowest ,Top 5 and Least 5. Each option has a query: For example ... by bhaskarasplunk Explorer in Splunk Enterprise Security 02-26-2019 0 2	0	2
Unable to distribute to peer from search head Hi, We are facing this issue frequently in splunk search head. Please help me. Unable to distribute to peer named ... by raghu_vedic Path Finder in Splunk Enterprise Security 02-25-2019 0 2	0	2
Monitor correlation/notable/incident review Splunk ES How can I monitor if all correlations open incidents into "Incident Reviews" in Splunk ES correctly? by danielearangiom Explorer in Splunk Enterprise Security 02-25-2019 0 2	0	2
Do we have option in Splunk enterprise security to check the command output We created Dashboard in Splunk enterprise security where we can see the commands status and risk score for those comm... by sahiltcs Path Finder in Splunk Enterprise Security 02-25-2019 0 8	0	8
how do i monitor network data using netflow analyzer ? hello, how do i monitor network data using netflow analyzer? i have installed add on of netflow analyzer.please tell ... by rajpingale123 Engager in Splunk Enterprise Security 02-22-2019 0 1	0	1
In Splunk Enterprise Security, how do you access granular audit trails for user and role changes? I was looking for a way to view WHAT exactly was audited when someone changes a ROLE or USER (capabilities, inherited... by MatthewH007 Path Finder in Splunk Enterprise Security 02-22-2019 2 0	2	0
How to write a Splunk alert to find malicious C2 traffic using Cisco IPS logs Guys, Any idea of writing a splunk query to find the malicious command and control traffic using Cisco IPS logs. We ... by sivasankarketin New Member in Splunk Enterprise Security 02-22-2019 0 2	0	2
With Splunk Enterprise Security, I'm getting varying IP geo-location results when comparing Splunk to third-party resources — how frequent are Splunk geo cache updates? Hi, I'm getting varied results in Splunk when I investigate an IP address' location. Splunk might say "Netherlands",... by crumblecat88 Engager in Splunk Enterprise Security 02-22-2019 0 1	0	1
no expected fields in sourcetype Hello all! resently i downloaded Check Point App for Splunk. I configured in input.conf in order to force all Chech... by infosec_kicb New Member in Splunk Enterprise Security 02-22-2019 0 4	0	4
How to create Enterprise Security custom roles and have Notables dashboard different for each roles? hi anyone created "custom" roles in Enterprise Security and re-used the notables dashboard (security events) ? We ha... by koshyk Super Champion in Splunk Enterprise Security 02-22-2019 0 3	0	3
How do you pass the same token for two panels with one drop-down input? I want to pass a token from one panel to another panel. I mean, if I give one input in the drop down, it has to updat... by bhaskarasplunk Explorer in Splunk Enterprise Security 02-21-2019 0 2	0	2
Symantec MSS integration with Splunk for orchestration and Incident Management Dear ALL , I am searching a procedure to pull and update the incidents from Symantec MSS created by their SOC they... by sonin New Member in Splunk Enterprise Security 02-20-2019 0 0	0	0
Nessus Home and Splunk Add-On for Tenable Does this TA Support Nessus Home installations? I've tried to use Tenable.io and authentication seems to work but no... by tmiller_splunk Splunk Employee in Splunk Enterprise Security 02-19-2019 0 2	0	2
In Splunk Enterprise Security, how do you combine two searches into one query and group on a specific field? I am trying to create a query where there are two different searches that each produce a point in time for each devic... by iomega311 Explorer in Splunk Enterprise Security 02-19-2019 0 2	0	2
Fortigate logs are not in CIM format I installed Fortinet Fortigate Add-on for Splunk 1.6.0 and Fortinet Fortigate App for Splunk 1.4. Sourcetypes are ide... by map000 New Member in Splunk Enterprise Security 02-18-2019 0 3	0	3
Notable Event Urgency issues I have setup a few correlated events which currently are showing up in the incident review console as urgency (unknow... by 04cjm Engager in Splunk Enterprise Security 02-14-2019 1 3	1	3
Multiple tstats with prestats append=t not working in ES app Hi, I'm querying a datamodel X and I need to append results with same fields names from datamodel xx using. I'm try... by vj8210 Explorer in Splunk Enterprise Security 02-13-2019 1 2	1	2
Splunk Enterprise Security Alexa Domain NOT lookup failing Hello, I am trying to create alerts for all outbound DNS queries which do not match the top one million domains as p... by HannanPervez Explorer in Splunk Enterprise Security 02-13-2019 0 5	0	5
Threat Intelligence by default, where from threat Intelligence feed downloaded in splunk ? by godawatnikunj19 New Member in Splunk Enterprise Security 02-12-2019 0 1	0	1
Splunk Enterprise Security - Host Sending Excessive Emails Alert / Email Data model Hi Everyone I'm having trouble with one of the alerts in Enterprise Security which is causing a lot of noise and fal... by kamoenix New Member in Splunk Enterprise Security 02-11-2019 0 3	0	3
Subsearch relative to base search time Hello, I'm looking into a way to discover following scenario in my ingested logs: some user logged out and didn't lo... by hoytn Explorer in Splunk Enterprise Security 02-11-2019 0 2	0	2

Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars Sometimes, you just need to see the code. For those looking for a ...

Splunk Enterprise Security

Alert triggering on an entry not in inputlookup file

How to whitelist events using inputlookup?

Does a license key(or file) is required to “activate” the Splunk ES App?

whether a license key is required for the ES app or not?

In Splunk Enterprise Security, how do you change a query result when a drop down option is selected within a panel?

Unable to distribute to peer from search head

Monitor correlation/notable/incident review Splunk ES

Do we have option in Splunk enterprise security to check the command output

how do i monitor network data using netflow analyzer ?

In Splunk Enterprise Security, how do you access granular audit trails for user and role changes?

How to write a Splunk alert to find malicious C2 traffic using Cisco IPS logs

With Splunk Enterprise Security, I'm getting varying IP geo-location results when comparing Splunk to third-party resources — how frequent are Splunk geo cache updates?

no expected fields in sourcetype

How to create Enterprise Security custom roles and have Notables dashboard different for each roles?

How do you pass the same token for two panels with one drop-down input?

Symantec MSS integration with Splunk for orchestration and Incident Management

Nessus Home and Splunk Add-On for Tenable

In Splunk Enterprise Security, how do you combine two searches into one query and group on a specific field?

Fortigate logs are not in CIM format

Notable Event Urgency issues

Multiple tstats with prestats append=t not working in ES app

Splunk Enterprise Security Alexa Domain NOT lookup failing

Threat Intelligence

Splunk Enterprise Security - Host Sending Excessive Emails Alert / Email Data model

Subsearch relative to base search time

Splunk MCP & Agentic AI: Machine Data Without Limits

Finding Based Detections General Availability

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Splunk enterprise security export content in SHC t...

add enrichment in splunk ES8

mc_investigations data is not populated - ES 8.3

Delay Sending Threats from Splunk ES to Splunk SOA...

Upgrading from ES 7 to 8

Splunk Enterprise Security

Join the Conversation