How we can optimize dlp search?

[smith_]

Hi all,

We are looking for users that trigger one or more of these policies:

policy="[DLP] -  Internal " OR policy="[SMTP] - Gmail - Internal " OR  policy="[DLP] - GDrive - Internal " AND one or more of these policies:

policy="All DLP Policies" and activity=upload Please exclude all  instances from this search (provided below lookup)

OR

policy="[SMTP] -  Password Protected " Please exclude all  instances from this search (provided below lookup)

OR

alert_type=uba and alert_name=" suspicious  uploads" Please exclude all  instances from this search (provided below lookup )

eg.

Full list of instance IDs:
xyz.com
abc.com
123.com
786.com
143.com
etc.
Please let me know if you have any questions.


Thanks,

[smith_]

Hi @ITWhisperer  @gcusello  need help in building the search for above scenario.

[gcusello]

Hi @smith_,

we'd like to help you, but it's very difficoult without a sample of your data, and anyway, I see all the conditions and I suppose that it isn't possible to optimize these conditions!

But what's the issue: is it slow?

If it's slow, you can try some method to accelerate searches (e.g. https://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/Aboutsummaryindexing).

Ciao.

Giuseppe

[ITWhisperer]

This is an almost impossible question to answer without knowledge of your data set and what your current issues are and what splunk is already doing in terms of optimisations.

[gcusello]

Hi @smith_,

I don't see any possible optimization: these are the conditions!

Ciao.

Giuseppe