Hi, We are using the Lookup File Editor App for Splunk Enterprise and when someone tries to open my csv via the app, they receive an error about not being able to load the details of the lookup file. I've set the permissions of the file to global and ensure the user had read/write access. When I set the file to be owned by nobody, they are able to open and edit. I did find the following in the log file. 2016-04-07 00:33:22,471 DEBUG [57060d42717f15c73b7bd0] _cplogging:55 - [07/Apr/2016:00:33:22] HTTP Traceback (most recent call last): File "/opt/splunk/lib/python2.7/site-packages/cherrypy/_cprequest.py", line 606, in respond cherrypy.response.body = self.handler() File "/opt/splunk/lib/python2.7/site-packages/cherrypy/_cpdispatch.py", line 25, in __call__ return self.callable(*self.args, **self.kwargs) File "", line 1, in File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 38, in rundecs return fn(*a, **kw) File "", line 1, in File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 118, in check return fn(self, *a, **kw) File "", line 1, in File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 167, in validate_ip return fn(self, *a, **kw) File "", line 1, in File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 335, in preform_sso_check return fn(self, *a, **kw) File "", line 1, in File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 387, in check_login return fn(self, *a, **kw) File "", line 1, in File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 407, in handle_exceptions return fn(self, *a, **kw) File "", line 148, in get_lookup_info File "", line 460, in resolve_lookup_filename File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 548, in get return SplunkRESTManager(cls, sessionKey=sessionKey).get(id) File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 528, in get entity = self._get_entity(id, host_path=host_path) File "/opt/splunk/lib/python2.7/site-packages/splunk/models/base.py", line 444, in _get_entity return self._fix_entity(splunk.entity.getEntity(self.model.resource, None, sessionKey=self.sessionKey, uri=id)) File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 249, in getEntity serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 514, in simpleRequest raise splunk.AuthorizationFailed(extendedMessages=uri) AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/myusername/search/data/lookup-table-files/mycsv.csv Any suggestions? Thank you, Todd ... View more

So I wanted to field this question out to the community. I'm looking to ensure that I'm covering as many attack vectors with my alerting as possible. I know that all environments differ in many ways, but has the community come up with a list of common attack vectors (queries) that all networks should be looking for? Examples would be: SSH brute force attempts Inactive accounts being used Brute force attempts that have 1 success I would really like to know what others are doing. No suggestion is too simple or crazy. If this has been discussed in the past, can you point me in that direction? ... View more