Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About adalbor
adalbor
Builder
Member since:
01-29-2019
02-25-2022
Community Statistics
| Posts | 172 |
| Solutions | 14 |
| Karma Given | 74 |
| Karma Received | 17 |
| Member Since | 01-29-2019 |
Activity Feed
- Got Karma for Re: Proofpoint Email Security Add-On: Issues with dashboard population and extractions. 01-09-2023 06:38 AM
- Got Karma for Proofpoint Email Security Add-On: Issues with dashboard population and extractions. 01-09-2023 05:52 AM
- Got Karma for Errors with Rapid7 InsightVM TA. 02-24-2022 06:08 PM
- Got Karma for Re: Microsoft Office 365 Reporting Add-on for Splunk is affected by stop supporting and retire Basic Authentication for. 01-18-2022 06:37 AM
- Karma Re: How to configure Splunk to extract XML fields from Windows security event 4698? for krishnarajapant. 07-12-2021 10:41 AM
- Posted Errors with Rapid7 InsightVM TA on All Apps and Add-ons. 06-15-2021 09:00 AM
- Karma Re: Splunk Add-on for Microsoft Cloud Services vs Microsoft Azure Add on for Splunk for grobendg. 06-14-2021 05:45 AM
- Karma Re: Splunk Add-on for Microsoft Cloud Services vs Microsoft Azure Add on for Splunk for venkatasri. 06-11-2021 11:18 AM
- Posted Re: Splunk Add-on for Microsoft Cloud Services vs Microsoft Azure Add on for Splunk on All Apps and Add-ons. 06-11-2021 11:15 AM
- Posted Splunk Add-on for Microsoft Cloud Services vs Microsoft Azure Add on for Splunk on All Apps and Add-ons. 06-10-2021 10:53 AM
- Posted Re: Splunk Logs to Azure Blob Storage on Getting Data In. 05-19-2021 10:20 AM
- Posted Re: Windows Eventlog field suppression in 8.1.1 on Getting Data In. 04-29-2021 06:45 AM
- Posted Windows Eventlog field suppression in 8.1.1 on Getting Data In. 04-29-2021 06:34 AM
- Karma Re: O365 message tracking logs for J_lo. 02-02-2021 07:58 AM
- Karma Re: ERROR lookup minemeldfeeds for scelikok. 02-01-2021 11:54 AM
- Karma Re: Splunk Permission Error for nickhills. 12-15-2020 11:23 AM
- Posted Calculate Bucket Thaw Time on Splunk Search. 12-15-2020 10:25 AM
- Posted Re: Ingesting logs from Microsoft Teams on All Apps and Add-ons. 12-15-2020 10:12 AM
- Got Karma for Re: Upgrade from 7.3.7 to 8.0.6. 10-08-2020 06:18 AM
- Got Karma for Upgrade from 7.3.7 to 8.0.6. 10-08-2020 06:18 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-07-2019
10:59 AM
Or should it look like this?
EventCode="4674" Message="(?:Account\sName:\s+ACCOUNTNAME).+(?:Process\sName:\s+?:\wbem\WmiPrvSE.exe)
... View more
08-07-2019
10:36 AM
Hey All,
I am looking to add a blacklist entry to our inputs for our Windows UF's that would blacklist based on the event code, a process name (with wildcard path), and a specific account name.
Would it be as simple as?:
blacklist = EventCode="4674" User="user" Process_Name="*\blah.exe"
Or would I need a regex with user and process name trying to match on the message field?
Ive written some with Event Code and Process Name but never specific enough with a user.
Thanks!
Andrew
... View more
08-01-2019
01:10 PM
Hey All,
I need some assistance with completing some search parameters.
I created a search to correlate emails going in and out of proofpoint according to the message_session_id using transaction and displaying in a table format. Proofpoint generates multiple events for a single message which requires stitching it all together.
I would like to turn this into a dashboard with two search boxes that would allow me to specify the search parameters for the sender and recipient while still maintaining the correlation using transaction.
Here is my current search:
index=proofpoint
| transaction message_session_id
| table from to subject file_name rule action
| fillnull value=n/a
Would I achieve this using tokens? Or how would I go about this?
... View more
07-29-2019
08:27 AM
Thanks for the info. Exactly what I am doing now.
I have run into an interesting issue maybe someone can help with. In creating the search in the data model constraints there is a discrepancy.
A search in the preview pane for the Data model for past 7 days returns 2 results in ES.
When I run it on my SHC it returns 30 results using the same query.
I have tried without the macro as the macro is not set on the SHC.
Any ideas why it would do this?
... View more
07-24-2019
07:37 AM
Thanks, great info and appreciate the help.
Here is the odd thing, when I look at the apps applying the tags. None of the searches actually line up with these events being tagged with the malware tag. These are McAfee AV events and the McAfee TA eventtypes.conf does not appear to tag these specific events with the malware tag.
... View more
07-23-2019
12:09 PM
So just to verify I am doing the right thing.
After validating that app that is adding the tags, I go into eventtypes.conf in that app and place in local folder then remove tag from that specific eventtype?
... View more
07-23-2019
11:12 AM
Hey All,
Running CIM in our ES instance and I had some questions around tagging or NOT tagging data.
Whats the best way to go about excluding certain events from being tagged by a data model.
Example: Malware data model looks at everything in the CIM indexes you specify during setup.
Our AV reports on events that aren't malware related but because the data model references that index everything is tagged as malware thus resulting in false positives. Whats the best practice/way to go about ensuring that data is not tagged as such?
Can we exclude by signature? Or event code?
Thanks,
Andrew
... View more
07-22-2019
10:57 AM
Thanks for the info. We have an app that we deploy with these settings but the deployment manager doesn't list itself in the list of servers to deploy too. Hence why I deployed to system/local.
... View more
07-22-2019
08:34 AM
That is what I needed.
Thank you, I just put a copy of the indexes.conf into system/local on my deployment manager to achieve this.
... View more
07-22-2019
05:47 AM
No that doesn't, thank for the info anyways.
In my deployment manager under the role settings you are able to setup access to indexes via the GUI.
All of my indices are not showing up under the GUI.
I am asking do I need to deploy my indexes.conf to this server for them to show up? Or should I just assign access to indices via the authorize.conf in my ldap app that is deployed environment wide?
... View more
07-19-2019
12:43 PM
Hey All,
I am working on setting up RBAC roles that restrict access to specific indexes.
In the GUI of my deployment manager I am not seeing all of the indexes. Should I add an indexes.conf to the local on that box?
Or should I just add the index names to the authorize.conf?
Also if I add them into authorize.conf will they show in the GUI?
Thanks!
Andrew
... View more
07-19-2019
07:05 AM
That was too easy! Thank you!
I used
index=wineventlog
| dedup EventCode
| table EventCode,Message
... View more
07-18-2019
11:16 AM
Does anyone know of a good way to pull one event of a specific eventcode/type when searching for multiple eventcodes?
It doesn't appear that event sampling can do something like that.
I was hoping to run a search for all Windows EventCodes and to only return one event of each type.
Is that possible?
Thanks,
Andrew
... View more
07-17-2019
11:21 AM
Just to add and mark as complete.
Their newest app version 6.4 has the integration built in.
All you have to do is rerun setup, tell it to use CIM data models, and check that Upload to ES Threat Intelligence Framework is ticked within:
Settings -> Data Inputs -> Anomali IOC Ingestion -> threatstream_app
Once that stuff was done it worked like a charm.
... View more
07-16-2019
12:59 PM
Bump...
Just to add I have looked for documentation but so far nothing concrete. Support tells me they have seen customers do it but have no documentation or recommendations for me.
... View more
07-16-2019
10:03 AM
That really stinks. Thanks for the info on using REST.
Just gotta do it the hard way I suppose.
... View more
07-16-2019
06:44 AM
Does anyone know an easy way to inventory installed applications across all components in your Splunk environment?
Deployment server doesn't really list the actual app versions and I was hoping to find a way to keep an updated app inventory for when we perform upgrades to our environment.
I know I can get the app versions from the Manage Apps page on ES and SHC but was hoping for an easier way.
... View more
07-16-2019
06:30 AM
Def check the Anomali documentation for more information.
That being said the filter states that you only want active IOC's, confidence level greater than or equal to 90 (extremely confident the intel is correct), the ioc was created greater than 5 days ago, the IOC is not an IP associated with scanning activity, the IOC is not a compromised email address, and the IOC is not a malicious file hash.
Get with Anomali support to help you fine tune this. Its better to tune your IOC collection at the Anomali lvl.
... View more
07-15-2019
07:26 AM
Hey All,
We currently have Splunk deployed in our Azure instance and are at the point where we are attempting to set up cold storage for our Splunk environment.
Does anyone have any documentation/requirements/best practices for using Azure blob storage for this purpose?
We aren't quite sure how to proceed as archival storage in the cloud is new for us.
Thanks!
Andrew
... View more
07-12-2019
10:43 AM
The above didn't work and I tried changing the wildcard to a period and still nothing.
Anyone have any recommendations to make this work?
... View more
07-10-2019
12:26 PM
Well after days of banging my head up against a wall I finally discovered the issue.
Because we collects logs from Forwarded Events log locations and Security log locations we have two main windows sourcetypes.
Our event truncation props.conf only covered WinEventLog:Security.
I had no idea we had another sourcetype as the Splunk_TA_Windows did a rename to normalize all of the sourcetypes to the same at search time. So when I would run a search and see some events truncated and some not I had no clue.
Once I added the Forwarded Events sourcetype to my props (deployed via a custom app) everything worked as it should!
Below is what I used as reference:
[WinEventLog:Security]
SEDCMD-shorten1=s/(?s)This event is generated .+$//
SEDCMD-shorten2=s/(?s)Certificate information is only provided .+$//
SEDCMD-shorten3=s/(?s)Token Elevation Type indicates the type of token .+$//
[WinEventLog]
SEDCMD-shorten4=s/(?s)This event is generated .+$//
SEDCMD-shorten5=s/(?s)Certificate information is only provided .+$//
SEDCMD-shorten6=s/(?s)Token Elevation Type indicates the type of token .+$//
[WinEventLog:ForwardedEvents]
SEDCMD-shorten7=s/(?s)This event is generated .+$//
SEDCMD-shorten8=s/(?s)Certificate information is only provided .+$//
SEDCMD-shorten9=s/(?s)Token Elevation Type indicates the type of token .+$//
[source::WinEventLog:ForwardedEvents]
SEDCMD-shorten10=s/(?s)This event is generated .+$//
SEDCMD-shorten11=s/(?s)Certificate information is only provided .+$//
SEDCMD-shorten12=s/(?s)Token Elevation Type indicates the type of token .+$//
... View more
07-10-2019
06:50 AM
1 Karma
My hero! Worked perfectly now thank you!
index=wineventlog
| fields _raw EventCode
| eval esize=len(_raw)
| stats count as count avg(esize) as avg by EventCode
| eval bytes=count*avg
| eval kb=bytes/1024
| eval mb=round(kb/1024,2)
| eval gb=round(kb/1024/1024,2)
| stats sum(count) as events values(mb) AS MB, values(gb) as GB by EventCode
... View more
07-10-2019
05:46 AM
Putting that at the end of my last stats command doesn't appear to work. The search returns no results when using that.
... View more
07-09-2019
11:57 AM
Thats super close to what I need. Was hoping to add the number of events per event code to that.
... View more
07-09-2019
11:38 AM
1 Karma
Hey All,
I am trying to calculate the number of events per EventCode along with the total size in kb/mb of all events for that EventCode in a time period.
I was hoping to table that data by Event Code.
This is what I have so far but I am struggling with getting a count of each EventCode and listing the sizing in a table.
index=wineventlog EventCode=4624
| fields _raw
| eval esize=len(_raw)
| stats count as count avg(esize) as avg
| eval bytes=count*avg
| eval kb=bytes/1024
| eval mb=round(kb/1024,2)
| stats values(kb) as KB, values(mb) AS MB
This works for a single event code but I need to list all EventCodes and how much storage each are using in total.
Any help would be great!
Thank you!
Andrew
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-25-2022
07:48 AM
|
Karma from
Karma given to
