Anyone has any experience in ingesting Incidents from Microsoft Sentinel (formerly Azure Sentinel)? I found info about the https://splunkbase.splunk.com/app/4564 add-on which works with Graph Security which is supposed to be a "middleware" of sorts between different kinds of security events but on the other hand I find that data pulled this way is very limited in terms of details. So I thought about callind Sentinel API directly. There is supposedly API we could use, it has PowerShell module, I'm not sure about decent "curlable" docs but I didn't look very hard for it. Yet. The question however is are we doomed to write something completely from scratch or is there anything ready that I could use?

Sample Event:  sent=1 received=0 packet_loss=100 min_ping=NA avg_ping=NA max_ping=NA jitter=NA return_code=1 dest=SHTCE***   Tried code: index=network | eval Availability= case(received="1", 100,received="0", 0) | stats avg(Availability) by dest | sort +avg(Availability) | rename avg(Availability) as "Availability %" | streamstats current=f latest(packet_loss) as packet_loss latest(_time) as last_checked latest(_raw) AS prevEvent by dest | eval downtime = _time - last_checked | rename dest as Host | table Host  

i have a table case id severity open date status age 3241765 critical 6/5/2022 awaiting 30 days 9847636 high  1/6/2022 pending 5 days   i want to highlight the table by queries like those: if severity=critical AND status=awaiting or pending - highlight the values critical and awaiting in red if severity=critical AND status=awaiting or pending more than 30 days- highlight the row in red if case is open more then 30 days - mark the cell in red.

My Splunk Cloud Free Trial allow me to login, also offer option to upload test data. We need to check out the REST API provided by Splunk for Search for use by our own test application from computer Please advice how Splunk Cloud Free Trial can be setup for REST API access from internet.

Hello All, I have integrated spring boot application with AppDynamics. I need to collect Request methods(GET,POST,DEL) and Status Codes(200..) in my data collectors. I am able to collect User-Agent, Host using  HTTP Request Data Collectors but not Request Methods and Status codes.  

Hi,  The DMC got an alert "DMC Alert - Search Peer Not Responding".. it works fine when a search peer goes down, but then when it come back, we should get an alert/notification saying "Search Peer up now", right, but, somehow the DMC/Splunk developers missed to consider this situation/condition.  i can check the "DMC Alert - Search Peer Not Responding" alert's search query and modify it to create the opposite.. like "DMC Alert - Search Peer Responding Fine" Now the question is...the "DMC Alert - Search Peer Responding Fine" alert should work only after the first SH down alert. hope you got this issue. Please suggest how we can achieve this, thanks.   

Hello All, I have integrated UF with splunk v8.2 but getting unnecessary host from where I'm getting logs. Not sure how they started sending logs. Is there a way I can stop and check it, why it started and how I can stop them? Below screenshot for reference   

We have a PCI requirement to disable TLS1.1 or TLS1.0 cipher suites such as - TLSv1.0 TLS_DHE_RSA_WITH_AES_128_CBC_SHA - TLSv1.0 TLS_DHE_RSA_WITH_AES_256_CBC_SHA - TLSv1.0 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA - TLSv1.0 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA - TLSv1.1 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA - TLSv1.1 TLS_DHE_RSA_WITH_AES_128_CBC_SHA - TLSv1.1 TLS_DHE_RSA_WITH_AES_256_CBC_SHA Among others...   I checked a few docs and tested disabling anything less then TLS 1.2 in sslVersions = tls1.2 https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/SetyourSSLversion   How can i be sure the above cipher suites are disabled and TLS 1.2 is the only allowed? from previous posts i read we can use openssl to test via and look for any errors or the full certificate response if its open? openssl s_client -connect ipaddress:port -tls1_1our currrent server.conf is as follows Here is our current server.conf [sslConfig] sslVersions = *,-ssl2 sslVersionsForClient = *,-ssl2 cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH