Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About AL3Z
AL3Z
Builder
Member since:
12-17-2022
Tuesday
Community Statistics
| Posts | 508 |
| Solutions | 0 |
| Karma Given | 134 |
| Karma Received | 0 |
| Member Since | 12-17-2022 |
Activity Feed
- Posted Re: ** windows sytem logs are not coming to splunk ** on All Apps and Add-ons. 03-04-2025 08:24 AM
- Karma Re: ** windows sytem logs are not coming to splunk ** for livehybrid. 03-04-2025 05:33 AM
- Karma Re: ** windows sytem logs are not coming to splunk ** for gcusello. 03-04-2025 05:32 AM
- Posted Re: ** windows sytem logs are not coming to splunk ** on All Apps and Add-ons. 03-04-2025 05:30 AM
- Posted Re: ** windows system logs are not coming to splunk ** on All Apps and Add-ons. 03-04-2025 02:58 AM
- Posted Re: ** windows sytem logs are not coming to splunk ** on All Apps and Add-ons. 03-04-2025 02:04 AM
- Posted ** windows system logs are not coming to splunk ** on All Apps and Add-ons. 03-04-2025 12:37 AM
- Posted What kind of scenario we use eventstats vs stats? on Splunk Search. 01-06-2025 08:30 AM
- Posted Re: setup splunk/forwader in the same platform on Getting Data In. 08-12-2024 05:03 AM
- Posted setup splunk/forwader in the same platform on Getting Data In. 08-12-2024 03:28 AM
- Posted Re: Splunk ES from Zero on Security. 06-19-2024 05:07 AM
- Posted Splunk ES from Zero on Security. 06-19-2024 01:16 AM
- Posted Splunk fundamentals 1 on Getting Data In. 03-26-2024 05:04 AM
- Posted Lateral movement search needed on Splunk Search. 03-21-2024 11:48 AM
- Posted Need an dashboard spl on Splunk Search. 03-16-2024 03:33 AM
- Posted Re: Please help me in tuning this search.. on Splunk Enterprise Security. 02-27-2024 08:38 AM
- Posted Re: Please help me in tuning this search.. on Splunk Enterprise Security. 02-25-2024 09:15 AM
- Karma Re: How to Spot the Signs of Lateral Movement for VatsalJagani. 02-25-2024 05:30 AM
- Posted Please help me in tuning this search.. on Splunk Enterprise Security. 02-25-2024 05:29 AM
- Posted How to Spot the Signs of Lateral Movement on Splunk Enterprise Security. 02-21-2024 05:18 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-05-2023
03:22 AM
@yuanliu , above dates are just for reference we need to make a generic to work for all the dates like above !
... View more
12-04-2023
09:26 AM
@richgalloway , I'm aiming to upgrade my Splunk Enterprise on the deployment server, but I'm uncertain whether it's configured as standalone or distributed. How can we verify this and proceed with the upgrade accordingly? Additionally, does the upgrade process differ between standalone and distributed setups?
... View more
12-04-2023
08:10 AM
Hi, How do we copy the files .tgz from windows server to the Linux box ? Can anyone help me in doin this?
... View more
12-04-2023
12:11 AM
@gcusello , Tried this Search not giving the desire result | eval from_epoch = strptime(from, "%m/%d/%Y %I:%M %p") | eval till_epoch = strptime(till, "%m/%d/%Y %I:%M %p") | eval diff_seconds = till_epoch - from_epoch | eval diff_years = floor(diff_seconds / (365.25*24*60*60)) | eval remaining_seconds = diff_seconds - (diff_years * 365.25*24*60*60) | eval diff_days = floor(remaining_seconds / (24*60*60)) | eval remaining_seconds = remaining_seconds - (diff_days * 24*60*60) | eval diff_hours = floor(remaining_seconds / (60*60)) | eval diff_minutes = floor((remaining_seconds - (diff_hours * 60*60)) / 60) | eval duration = diff_years . " year" . if(diff_years != 1, "s", "") . " " . diff_days . " day" . if(diff_days != 1, "s", "") . " " . diff_hours . " hour" . if(diff_hours != 1, "s", "") . " " . diff_minutes . " min" output: 11/28/2023 05:10 PM 11/28/2024 05:40 PM 1 year 0 days 18 hours 30 min
... View more
12-04-2023
12:00 AM
@gcusello , duration is showing like 366+00:30:00.000000 how we can change it eg: 0 years 181 days 23 hours 30 min
... View more
12-03-2023
11:39 PM
Hi, How we can find the difference of these two date difference in year days hour min from till 11/28/2023 03:38 PM 11/28/2024 04:08 PM
... View more
12-02-2023
09:54 PM
Hi @scelikok , Why is everything associated with EventCode="4688" being blocked after applying this Regex blacklist? blacklist3 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name=('NewProcessName'|'ParentProcessName')>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe"
... View more
12-01-2023
11:14 PM
Hi, Is it possible for someone to aid me in reformatting the given events to align with the structure present in blacklist3, organizing them into their respective blacklists or potentially amalgamating them into a unified blacklist? blacklist3 = $XmlRegex="<EventID>4688<\/EventID>.*<Data Name=('NewProcessName'|'ParentProcessName')>[C-F]:\\Program Files\\Splunk(?:UniversalForwarder)?\\bin\\(?:btool|splunkd|splunk|splunk-(?:MonitorNoHandle|admon|netmon|perfmon|powershell|regmon|winevtlog|winhostinfo|winprintmon|wmi))\.exe" Tanium Events: C:\\Program Files \(x86\)\\Tanium\\Tanium Client\\Tools\\StdUtils\\TaniumExecWrapper\.exe| C:\\Program Files (\x86\)\\Tanium\\Tanium Client\\Patch\\tools\\TaniumExecWrapper\.exe| C:\\Program Files \(x86\)\\Tanium\\Tanium Client\\TaniumClient\.exe| C:\\Program Files \(x86\)\\Tanium\\Tanium Client\\Patch\\tools\\TaniumFileInfo\.exe| C:\\Program Files \(x86\)\\Tanium\\Tanium Client\\TaniumCX\.exe| C:\\Program Files \(x86\)\\Tanium\\Tanium Client\\python38\\TPython\.exe| C:\Program Files (x86)\Tanium\Tanium Client\Tools\Patch\7za.exe Windows defender: C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe C:\ProgramData\Microsoft\Windows Defender\Platform\.*\MpCmdRun.exe C:\ProgramData\Microsoft\Windows Defender\Platform\.*\MsMpEng.exe C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\.*\OpenHandleCollector.exe C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\.*\SenseCM.exe C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\.*\SenseIR.exe C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\.*\MsSense.exe C:\Program Files\Windows Defender\MpCmdRun.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\10.8560.25364.1036\SenseTVM.exe Rapid7 ParentProcessName count C:\Program Files\Rapid7\Insight Agent\components\insight_agent\3.2.4.63\ir_agent.exe C:\Program Files\Rapid7\Insight Agent\components\insight_agent\4.0.0.1\ir_agent.exe C:\Program Files\Rapid7\Insight Agent\ir_agent.exe C:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\.*\\get_proxy\.exe| Azure: C:\Program Files\AzureConnectedMachineAgent\ExtensionService\GC\gc_service.exe C:\Program Files\AzureConnectedMachineAgent\GCArcService\GC\gc_arc_service.exe C:\Program Files\AzureConnectedMachineAgent\GCArcService\GC\gc_service.exe C:\Program Files\AzureConnectedMachineAgent\GCArcService\GC\gc_worker.exe C:\Program Files\AzureConnectedMachineAgent\azcmagent.exe Gytpol: C:\\Program Files\\WindowsPowerShell\\Modules\\gytpol\\Client\\fw.*\\GytpolClientFW.*\.exe| forescout: ParentProcessName count C:\Program Files\ForeScout SecureConnector\SecureConnector.exe Thanks//..
... View more
Labels
- Labels:
-
blacklist
-
inputs.conf
-
universal forwarder
12-01-2023
10:23 PM
Hi,
Could anyone pls help me to conver this Blacklist to xml regex ?
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*(groupPolicyContainer|computer|user))"
Thanks..
... View more
Labels
- Labels:
-
universal forwarder
12-01-2023
08:36 AM
@gcusello @richgalloway Please correct me if I'm mistaken, but the source is where the data begins, while the endpoint acts as the destination or host where the data is either stored or received.
... View more
12-01-2023
05:26 AM
Hi, I am trying to get the information how many datasources and endpoints we have Integrated in to splunk.How can we get this information can anyone pls provide me a query to find this ..
... View more
Labels
- Labels:
-
stats
11-30-2023
09:52 AM
@isoutamo @richgalloway , Unable to access the backend for the splunk through putty netwotk is not allowing me to connect what could be the cause?
... View more
11-30-2023
02:18 AM
Hi, We need to upgrade our Splunk Enterprise from version 9.0.0 to 9.0.7 on the Deployment Server. Can someone please provide me with the steps required to perform this upgrade? I also need guidance on what needs to be backed up before executing this upgrade. Additionally, could you provide an estimation of the time required to complete this upgrade process? what about the time to complete these upgrade ?
... View more
Labels
- Labels:
-
upgrade
-
using Splunk Enterprise
11-29-2023
06:52 AM
@tscroggins @rasad4468 @richgalloway @PickleRick Can we use this method to blacklist like this blacklist3 = EventCode=%^4688$% Message=%SplunkUniversalForwarder% blacklist4 = EventCode=%^4688$% Message=%Tanium%blacklist5 = EventCode=%^4688$% Message=%Rapid7% my raw events are showing like this after adding why ?
... View more
11-28-2023
04:40 AM
@inventsekar , They recommended upgrading or updating the web.conf file in on-prem environment. How we can do this as its not the cloud its an enterprise.
... View more
11-27-2023
07:21 PM
@tscroggins , None of your shared Regex patterns are working https://regex101.com/r/i5cas6/1 Can you pls share your applied regex in regex101.
... View more
11-27-2023
09:53 AM
What if the Program.exe is present in NewProcessName and ParentProcessName which one do we need to apply it to Regex ??
... View more
11-27-2023
09:27 AM
@gcusello , Is this regex going to exclude all the windows events starting with this "\<Event xmlns\=\'http:\/\/schemas\.microsoft\.com\/win\/\d+\/\d+\/events\/event\'>" right? By the way my intention is to exclude all the secutiy tool events specific to eventcode 4688 eg, tanium,splunk ,windows defender etc., can we whitelist all the windows events like C:\\ Windows\\* we need to ingesting all the windows events like eg. cmd.exe,reg.exe etc., Thanks..
... View more
11-27-2023
09:12 AM
@gcusello , These are the events which I want to exclude <Data Name='NewProcessName'>C:\Program Files (x86)\Tanium\Tanium Client\Patch\tools\TaniumExecWrapper.exe</Data> <Data Name='ParentProcessName'>C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe</Data> <Data Name='NewProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe</Data> <Data Name='ParentProcessName'>C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Data> <Data Name='NewProcessName'>C:\Program Files (x86)\Tanium\Tanium Client\Patch\tools\TaniumFileInfo.exe</Data> <Data Name='ParentProcessName'>C:\Program Files (x86)\Tanium\Tanium Client\Patch\tools\TaniumExecWrapper.exe</Data> <Data Name='NewProcessName'>C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\10.8560.25364.1036\SenseCnCProxy.exe</Data> <Data Name='ParentProcessName'>C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\10.8560.25364.1036\MsSense.exe</Data>
... View more
11-27-2023
08:19 AM
HI @gcusello , I want to exclude these events by blacklisting on inputs.conf so that it can be stop ingesting into splunk .........
... View more
11-27-2023
06:19 AM
Hi, Is there someone here who can create an XML regular expression for these events to prevent them from being ingested into Splunk? 1. Sample Event: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{XXXXX}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><xxx>0</Opcode><Keywords>xxxxx</Keywords><TimeCreated SystemTime='2023-11-27'/><EventRecordID>151284011</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='8768'/><Channel>Security</Channel><Computer>XXX.com</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>xxx\SYSTEM</Data><Data Name='SubjectUserName'>XXX$</Data><Data Name='SubjectDomainName'>EC</Data><Data Name='SubjectLogonId'>xxx</Data><Data Name='NewProcessId'>0x3878</Data><Data Name='NewProcessName'>C:\Program Files (x86)\Tanium\Tanium Client\Patch\tools\TaniumExecWrapper.exe</Data><Data Name='TokenElevationType'>%%xxxx</Data><Data Name='ProcessId'>xxxx</Data><Data Name='CommandLine'></Data><Data Name='TargetUserSid'>NULL SID</Data><Data Name='TargetUserName'>-</Data><Data Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>xxx</Data><Data Name='ParentProcessName'>C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe</Data><Data Name='MandatoryLabel'>Mandatory Label\System Mandatory Level</Data></EventData></Event> THANKS
... View more
Labels
- Labels:
-
inputs.conf
11-27-2023
04:02 AM
Hi @gcusello , Need an help from you to decode the xml regex we have this C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe in NewProcessName and ParentProcessName tried regex: its not excluding the events even after placing these both combinations. blacklist4 = $XmlRegex=%<Provider[^>]+Name="Microsoft-Windows-Security-Auditing"% $XmlRegex=%<EventID>4688<\/EventID>% $XmlRegex=%<Data Name="NewProcessName">(C:\\Program Files \(x86\)\\Tanium\\Tanium Client\\TaniumClient\.exe)<\/Data>% blacklist5= $XmlRegex=%<Provider[^>]+Name="Microsoft-Windows-Security-Auditing"% $XmlRegex=%<EventID>4688<\/EventID>% $XmlRegex=%<Data Name="ParentProcessName">(C:\\Program Files \(x86\)\\Tanium\\Tanium Client\\TaniumClient\.exe)<\/Data>% Sample event: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2023-11-27T11:53:55.027269400Z'/><EventRecordID>151278170</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='10472'/><Channel>Security</Channel><Computer>xyz.com</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>NT AUTHORITY\SYSTEM</Data><Data Name='SubjectUserName'>Admin$</Data><Data Name='SubjectDomainName'>EC</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='NewProcessId'>0x36ec</Data><Data Name='NewProcessName'>C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe</Data><Data Name='TokenElevationType'>%%1936</Data><Data Name='ProcessId'>0x2888</Data><Data Name='CommandLine'></Data><Data Name='TargetUserSid'>NULL SID</Data><Data Name='TargetUserName'>-</Data><Data Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>0x0</Data><Data Name='ParentProcessName'>C:\Program Files (x86)\Tanium\Tanium Client\TaniumClient.exe</Data><Data Name='MandatoryLabel'>Mandatory Label\System Mandatory Level</Data></EventData></Event> Thanks..
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Tuesday
|
Karma given to
