About smoir_splunk

smoir_splunk · ‎05-04-2018

I'd suggest removing the renames and then use the incident review settings page to provide user-facing names for the custom fields. http://docs.splunk.com/Documentation/ES/5.0.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details

smoir_splunk · ‎05-02-2018

Correct! SHC is strange, so I totally understand wanting to follow up to make sure this will work the way you expect/hope. http://docs.splunk.com/Documentation/Splunk/7.1.0/DistSearch/PropagateSHCconfigurationchanges contains more details about how precisely the deployer works.

smoir_splunk · ‎05-01-2018

That option is not available from that view, you need to use the Content Management page and the interface inside of Splunk Enterprise Security

smoir_splunk · ‎05-01-2018

The security domain is defined in the notable event adaptive response action for the correlation search. An eval in the search is not the best way to do this. See step 6 here: http://docs.splunk.com/Documentation/ES/5.0.0/Admin/Configureadaptiveresponse#Create_a_notable_event

smoir_splunk · ‎05-01-2018

Only version 5.0.0 of Splunk Enterprise Security has the navigation described in the documentation you're reading. Previous versions you can use Configure > Data Enrichment > Lists and Lookups and create a lookup there. I don't recommend creating a lookup from the Splunk core manager, because then it won't be a managed lookup with additional metadata provided by ES.

smoir_splunk · ‎05-01-2018

the latter happens when you deploy out the upgraded configurations -- you copy the upgrade state from the staging server to the production deployer (per the docs: http://docs.splunk.com/Documentation/ES/5.0.0/Install/Upgradetonewerversion#Upgrade_Enterprise_Security_on_a_search_head_cluster) and then you deploy that out.

smoir_splunk · ‎04-30-2018

Nope, as I stated in the comments to my answer, the next release will be compatible, but we can't publicly comment about timelines. You can trust that we know this is a pain point for customers to have a lag time like this, and are working to address that.

smoir_splunk · ‎04-30-2018

If you manage your configurations on the deployer, then the migration script will make the changes necessary when you perform the upgrade on the staging server. There isn't any documentation about how to completely uninstall Splunk Enterprise Security, that might be something you would want professional services assistance with.

smoir_splunk · ‎04-27-2018

There is almost certainly other stuff going on behind the scenes, but incident review is always the most obvious one that is affected 🙂

smoir_splunk · ‎04-26-2018

The next release will be compatible, but we can't publicly comment about timelines. You can trust that we know this is a pain point for customers to have a lag time like this, and are working to address that.

smoir_splunk · ‎04-25-2018

There is no version of Splunk Enterprise Security that is compatible with Splunk Enterprise or Splunk Cloud 7.1 at this time.

smoir_splunk · ‎04-24-2018

http://dev.splunk.com/view/enterprise-security/SP-CAAAFBA will probably help you find information about the comment field, and http://docs.splunk.com/Documentation/ES/5.0.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details covers in more detail and more up-to-date how to get an additional field to appear on incident review.

smoir_splunk · ‎04-18-2018

Make sure correlation searches are enabled: http://docs.splunk.com/Documentation/ES/5.0.0/Admin/Configurecorrelationsearches#Enable_correlation_searches

smoir_splunk · ‎03-30-2018

All the ES searches run as admin, which is why everything is broken now 🙂 You are correct that it is fine to reassign all the objects to a service account. See http://docs.splunk.com/Documentation/ES/5.0.0/Install/ConfigureUsersRoles

smoir_splunk · ‎03-27-2018

Those messages might have been suppressed before the upgrade, and are now showing up because the method of displaying the messages changed. If your indexers meet the minimum system requirements listed on the page linked from the message, then those messages can be ignored (and might be getting displayed in error). The three messages should lead to three separate documentation pages about how to mitigate the issues, and only how to suppress if needed.

smoir_splunk · ‎03-26-2018

There are typos in your aliases, and I second @Splunker's suggestion of using "search" instead of "where". You also have 3 subsearches in a row; is there a way to combine those into one subsearch? something like: | search NOT [| inputlookup domain_controllers | table fqdn,host,ip | rename fqdn as Authentication.src | rename host as Authentication.src | rename ip as Authentication.src]

smoir_splunk · ‎03-13-2018

The other risk besides performance is literal app collisions, like another app using an app named SA-Utils that might break ES functionality. ES uses app imports to prevent some of the risks you mention, @mohammedsamir, but the conflicting SA-Utils app issue is one that exists with some apps.

smoir_splunk · ‎02-22-2018

Joon, your proposed upgrade path looks great. If you can do it all in one maintenance window, what @mdessus suggests should work. If you need to do it progressively over several maintenance windows, follow the steps you outline in your question.

smoir_splunk · ‎02-13-2018

Ahh yes, the fact that you can assign an ID is functionality that exists in 4.7.x. There isn't any way to create a unique row on the dashboard unless you clone the dashboard and modify the view directly. I don't really recommend that.

smoir_splunk · ‎02-13-2018

Version 4.7.0 of Enterprise Security provides this functionality! https://docs.splunk.com/Documentation/ES/4.7.4/User/Takeactiononanotableevent#Share_or_bookmark_a_notable_event

smoir_splunk · ‎01-05-2018

Try searching the index using the notable macro, rather than searching the index directly. See http://dev.splunk.com/view/enterprise-security/SP-CAAAFBA for more details.

smoir_splunk · ‎01-02-2018

Hmmmm. I have no more ideas.

smoir_splunk · ‎01-02-2018

Yeah, I figured you had 🙂 Wanted to make sure that wasn't what was happening, at least. This perplexes me. Are you getting an error, or how do you know that it isn't working?

smoir_splunk · ‎01-02-2018

The example in the developer docs could perhaps be clearer. The first half of the example search is creating a dummy risk object called "mysystem". The second half is what you would use in your own environment, with the first half of the search being something specific that narrows down the search results to the object that you want to adjust the risk score for. Is that what you're doing already?

smoir_splunk · ‎12-07-2017

I ended up editing my lookup to use the full state name. You could also use a lookup in the search to change the state name from the abbreviation to the full state name.

Posts	198
Solutions	42
Karma Given	134
Karma Received	180
Member Since	‎10-13-2015

Online Status	Offline
Date Last Visited	‎09-18-2020 04:39 PM

How can I graph the string/human-readable value of...

Why are the field names different when using |from...

How can I write my own adaptive response action?

Re: How to reference a token name with spaces in i...

Re: Enterprise Security: Upgrading from 4.1.x to 4...

Re: How do I set the security_domain in a notable ...

Re: How do I set the security_domain in a notable ...

Re: How to add a custom lookup in Enterprise Secur...

Re: Enterprise Security: Upgrading from 4.1.x to 4...

Re: Enterprise Security in Splunk 7.1

Re: Enterprise Security: Upgrading from 4.1.x to 4...

Re: Enterprise Security in Splunk 7.1

Re: Enterprise Security in Splunk 7.1

Re: Enterprise Security in Splunk 7.1

Re: Add comment field in incident review page.

Re: Notable Events index empty

Re: Any challenges running Splunk ES without admin...

Re: Splunk Enterprise Security 5.0 warning message...

Re: Using Inputlookup to Eliminate Search Results

Re: is it possible to install other Splunk Apps (C...

Re: Enterprise Upgrade Path

Re: Is it possible to create a unique row in a Spl...

Re: Is it possible to create a unique row in a Spl...

Re: Splunk Enterprise Security: What happens to ho...

Re: Splunk Enterprise Security: risk modifier from...

Re: Splunk Enterprise Security: risk modifier from...

Re: Splunk Enterprise Security: risk modifier from...

Re: How to create a choropleth map using state abb...

Join the Conversation