we are using Splunk Cloud i want to modify from address(Splunk Cloud alerts@splunkcloud.com ) and want to use custom email when an alert email is generated ... View more

Rule Name : Abnormally High Number of Endpoint Changes By User Description: Detects an abnormally high number of endpoint changes by user account, as they relate to restarts, audits, filesystem, user, and registry modifications. | tstats count from datamodel=Endpoint.Filesystem where Filesystem.tag="change" by Filesystem.user | eval change_type="filesystem",user='Filesystem.user' | tstats append=T count from datamodel=Endpoint.Registry where Registry.tag="change" by Registry.user | eval change_type=if(isnull(change_type),"registry",change_type),user=if(isnull(user),'Registry.user',user) | tstats append=T count from datamodel=Change.All_Changes where nodename="All_Changes.Endpoint_Changes" by All_Changes.change_type,All_Changes.user | eval change_type=if(isnull(change_type),'All_Changes.change_type',change_type),user=if(isnull(user),'All_Changes.user',user) | stats count as change_count by change_type,user | xswhere change_count from change_count_by_user_by_change_type_1d in change_analysis by change_type is above medium ... View more

in enterprise security in incidents additional fields for all incidents i am seeing Sourcetype= stash its not showing original source type name why? #Additional Fields# # Value# #Action# Operating System Linux Severity medium Sourcetype stash ... View more

can you see if these events can fit into the Malware data model LogName=Application SourceName=Trend Micro OfficeScan Server EventCode=800 EventType=3 Type=Warning ComputerName=XXXXXXX.XXXXXX.com User=NOT_TRANSLATED Sid=S-1-5-18 SidType=0 TaskCategory=System OpCode=None RecordNumber=432219 Keywords=Classic Message=C&C callback detected Compromised Host: XXXXXX-XX93 IP Address: XX.XXX.19.XX Domain: XXX prod-dba\ Date/Time: 1/2/2020 10:22:27 Callback address: xx.xxx.xx.43 C&C risk level: Dangerous C&C list source: Relevance Rule Action: Logged ... View more

| tstats summariesonly max(time) as _time,values(Web.http_method) as http_method,values(Web.status) as status,count from datamodel=Web.Web where * (Web.url="*") by sourcetype,Web.src,Web.dest,Web.url | drop_dm_object_name("Web") | fields _time,sourcetype,http_method,status,src,dest,url,count | regex url="http:\/\/[^\x2f]+\/([a-z]{3,}[-]){3}[a-z]+\/[0-9]{15,20}" in my lookup table I have 10 to 15 URL and each URL having malware name can some on help me how I can write search as far as I know we can use map command Lookup Table URL malwareName xxxxxxxxxxxxxx AnglerEK xxxxxxxxxxxxx xxxxxxxxx zzzzzzzzzzzzzz xxxxxxxxxx ... View more

we have a API URL need to push Jason data to Splunk Through Cloud HTTP EVENT COLLECTOR curl -X GET -u admin https://d*****.n******.com/api/1.0/devices/all ------- here is the API URL where we used to get data in to .txt file I have Splunk Cloud with Token needed curl command o push logs from API URL to Splunk ... View more

I pulled logs in to the Splunk from a Data base(MSSql) I am getting below errors on search head [idx-i-01f9410f9c9fa09f8.greendot.splunkcloud.com] Events might not be returned in sub-second order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk. [idx-i-0ad23d2bab064c5bc.greendot.splunkcloud.com] Error in 'IndexScopedSearch': The search failed. More than 1000000 events found at time 1571382000. can some one help me in fixing these errors ... View more

I created few correlation searches notable events in Enterprise security and in Incident Review - Table Attributes I added src_user , src_ip, src_dest I am not able to see results there can come one help me in fixing this? ... View more

my search | stats count(eval(Code="3011648")) as "Incorrect login code" I am counting incorrect login code from this I want to divide count by week Monday Tuesday Wednesday Thursday Friday Saturday and Sunday in Realtime I want to count last seven days in a dashboard Can some one help me please ... View more

Can you help map creating field extractions Please use the ES CIM model where possible for field names: There are some variations in the log files so I included these two that we’re looking at: 2019-09-17 **:**:**.**** [Level: INFO][Server: **********][ServerIP: ::1][ThreadId: 141][RequesterIP:**.***.1.1][Verb:POST][RequestUri:https://***svcv3/authenticationgateway/profile/******/login][Headers:[Connection:Keep-Alive|Content-Length:118|Content-Type:application/json|Accept:*/*|Accept-Language:en-us |User-Agent:iOS **Bank (Version 2.18.0 Build 80329; 12.4.1; en-US; iPhone(iPhone11,2); |X-GDC-DeviceID:BA8BB0C7-2FF8-4C37-B17B-A5F01148D38E|X-GDC-Digest:l2RLaisPFvk6libgtBFQb85Sh17kM5moYGp6ipQ2Su0=|X-GDC-SessionToken:fe9bc5d5-259d-402b-aa35-861e0d260068|X-GDC-Method:2|X-GDC-Timestamp:2019-09-17T22:41:10.009|Originator:FlexClient|X-GDC-Version:1.001|X-GDC-ApplicationID:10043|X-GDC-MessageID:BABBFB13-F781-4FF6-B777-894BAF5CBD8A|RequestId:AEABFB13-F781-4FF6-B777-894BAF5CBD8A|X-Forwarded-For:108.**.233.***, 127.**.242.145, 10.126.**.250|X-Original-URL:/***/auth/**/profile/tokens/login| "AuthenticationLevel":"1","WebUserToken":"354643"}"][TimeTaken:][StatusCode:Created(201)] 2019-09-13 23:**:51.3120 [Level: INFO][Server: *****SVC04][ServerIP: ::1][ThreadId: 58][Response:{ ErrorCode = 10003, ErrorDescription = Unable to process the login request, "Code":30116267 Below are the fields need to be extracted: Accept-Language User-Agent X-GDC-DeviceID X-GDC-SessionToken X-GDC-Method X-GDC-ApplicationID X-Forwarded-For X-Original-URL AuthenticationLevel WebUserToken StatusCode ErrorCode ErrorDescription Code For X-Forwarded-For, please only capture the first IP address. ... View more

we are using enterprise security we have 20 domain controllers we need to combine them and use in search ... View more

Offense Name: Interactive Login with Service Account Rule: Service accounts typically start with svc* Offense Name: Interactive Login with Local Administrator Rule: Local admin user is rs0 I want correlation search please ... View more