You could start by integrating your Splunk with LDAP so that your dashboard searches the AD data using LDAP queries. This app should help: SA-ldapsearch - https://splunkbase.splunk.com/app/1151 ... View more

Can you double-check that the configuration is correct on the deployment client? Using btool: $SPLUNKHOME$/bin/splunk btool deploymentclient list ... View more

Try modifying this CURL request to your needs (adjust the endpoint, search, and token) curl -k -H 'Authorization: Splunk <your_token_here>' https://your_searchhead_here:8089/services/search/v2/jobs/export -d search="search index=* | head 10 | table host"   ... View more

Certainly, you can edit the app code by cloning the app into a draft and then editing the carbonblack_connector.py file. ... View more

Unfortunately not. The configure_db_maintenance settings do not have that level of granularity. It applies to all containers. ... View more

You could hit the REST endpoint for approvals. (https://docs.splunk.com/Documentation/SOARonprem/6.2.1/PlatformAPI/RESTApproval) Unfortunately the docs do not include the POST requests for actually approving the task, so you'll have to do an approval in the web interface and then log the POST request using your browser dev tools. Then you can use that POST request to approve tasks without having to log into SOAR. You will need to provide authentication credentials or a token though. ... View more

An important thing to keep in mind with this configuration is that each transform will be applied to the events, so the first transform can change the destination index, but then the second transform can change the destination index again. If events are going to index2 but should be going to index1, it indicates that the regex for the rewrite_index_adm transform is matching on the events that should go to index1. Check your regexes and make sure that the regex for rewrite_ad_group_management ONLY applies to logs with EventCode 4728 or 4729, while the regex for rewrite_index_adm ONLY applies to the Eventcodes 4624,4634,4625 and for admin users. ... View more

Can you split your query into a set of smaller queries that index those rows into a summary index? ... View more

This error would indicate an authentication problem. You should double-check your SMTP settings to ensure that they contain authentication settings for a valid account that can send email through your email provider. ... View more

You also need the list_all_users capability in your role, to list all users. For the alerts, your user needs permission to read the alert to fetch triggered alerts. ... View more

What happens if you manually use the sendemail command? | makeresults | sendemail to="it-security@durr.com" subject="Test mail" message="Test mail message"   ... View more

It seems that splunklib is trying to get the obsolete pycrypto library. Ideally you should configure it to use the Cryptography or pycrypodome library. There is an answer here how to change splunklib to use pycryptodome: https://stackoverflow.com/questions/59104347/how-do-i-install-splunklib-for-python-3-7-on-windows In case that link goes down, here are the instructions: by Chris Chris Dec 2 2019, 8:42: I finally found the way to install it: Uninstall pycrypto pip uninstall pycrypto Install pycryptodome as replacement of pycypto pip install pycryptodome Install splunklib without dependencies pip install splunklib --no-deps Edit "pythonlib"\splunklib-1.0.0.dist-info\METADATA and replace "Requires-Dist: pycrypto" with "Requires-Dist: pycryptodome" install splunk-sdk pip install splunk-sdk check that everything is ok pip install splunklib   ... View more

I can't think of a practical way to make an alert that will alert once per title, but also have many separate rows per title. You may be trying to do too much with one module. You could set up the alert to use multi-value fields as per my previous suggestion, but then include a link in the alert to a separate search where each title is separate. ... View more

Splunk Enterprise Security is the official product to handle threat intelligence feeds and other security functions. Enterprise Security can be run on-prem as it is a Splunk app (albeit a large one). Unless you have a compelling reason not to use Enterprise Security, it is the best way to go. If Enterprise Security is not an option, then you could build your own threat intelligence feed functionality into Splunk Enterprise, but this would take a lot of work. You could pull the threat data into a KV store, then use searches to perform lookups against that KV store. Though these searches can become quite complicated when you are matching certain types of intel (e.g. IP, domain) against various other fields that can contain matching values.  ... View more

According to the documentation on the Details page of the splunkbase page at Splunkbase (https://splunkbase.splunk.com/app/1352), this app reads from the sourcetype cisco:ios. Make sure that when you configure the input for the labdata file, that you set the sourcetype to cisco:ios . Once this is done, the dashboards should work. ... View more

That sounds frustrating. Sometimes it takes time to receive a reply email. I've had these response emails arrive sometimes in the same day, other times it takes a few days to arrive. ... View more

Ideally you'd be able to chunk the Json log event into smaller subunits, but this depends on what your JSON log event looks like. If your json log events are over 10k characters long, they may be getting truncated. If this is the case, you can override the truncation by putting the following setting in a props.conf file on the indexing machines: [<yoursourcetype>] TRUNCATE = <some number above the size of your json logs, or 0 for no truncation> If your broken json logs in Splunk are less than 10k characters long, then it could be that Splunk is splitting the logs part-way through the json object, so you would need to set the LINE_BREAKER field so that it properly splits whole json objects. ... View more

Have a go with: | stats count values(srcip) as srcip values(dstip) as dstip by title   This should produce three rows and therefore 3 alerts, where the srcip and dstip are multi-value fields. ... View more

So you have previous alerts which send email successfully, but when you make new alerts, they do not send email? ... View more

Assuming you are only cim-normalizing Change->Account Management, you could filter the logs to object_type=user Make an eventtype with search string: <yoursearch> | search object_type=user ```Or put the above search filter in the first line of your search``` And set the tags to "change,account" Then you can make the action field cim-compliant by making a calculated field: Name: action Eval expression: case(action="create","created",action="delete","deleted",1=1,action) ... View more

You could try extracting the json object after message=, then spathing it until you get the fields you would like. E.g. index = xxx sourcetype=xxx "Publish message on SQS" bulkDelete | rex field=_raw "message=(?<message>{.*}$)" | spath input=message | spath input=errors{}.errorDetails | table eventSource statusCode statusText   ... View more

Just to add slightly to yuanliu's answer, you can use the "| addcoltotals" command if you would like to add another row containing the totals of the numerical columns. You'll have to convert the ones that contain non-numerical characters like the "(0%)" part. ... View more

Could you try explicitly disabling workload management? Tscroggins has the instructions to do that above. ... View more