Splunk Enterprise

Can I use exsl:document in Splunk ?

WOOOOONG__HERO
New Member

Hello. I am a security researcher analysing the CVE-2023-46214 vulnerability. 

I think this vulnerability have a problem using exsl:document.

So I want to block packets containing exsl:document, but do you use exsl:document in real life?

Is this a feature that is officially supported by Splunk?

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust
0 Karma

WOOOOONG__HERO
New Member

Yes. I know.
But what I'm wondering is if you actually use <exsl:document>, and if you do, how you use it formally, and if you don't mind blocking packets containing that namespace.

0 Karma
Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...