What is the best way to get last login value from DC  (we have ~60 DCs ) ... View more

Hi Are there any Splunk APP that provides dashboards for AWS WAF & IPS ? we didn't find any in Splunk App for AWS Security Dashboards ... View more

I am getting the below errors in index=_internal  for Splunk 8.2.5 the lookup is available and I am able to open it with my admin user  what can be the reason and how can be resolved  ? 07-21-2022 15:11:03.840 +0300 ERROR LookupProviderFactory [100328 TcpChannelThread] - sid:summarize_1658405463.11224 The lookup table 'all_eventName' is disabled. Contact your system administrator. 07-21-2022 15:11:03.840 +0300 ERROR LookupProviderFactory [100328 TcpChannelThread] - The lookup table 'all_eventName' does not exist or is not available. ... View more

Hi We are looking a way to integrate Checkmarx with  Splunk what will be the best way  ? ... View more

I have syslog-ng configuration that started duplicating the events after the Linux box reboot  is there any way to avoid it  ? the are 2 heavy forwarders defined for the same load balancer and only 1 is duplicating the events in the syslog files created    [root@ilissplfwd07 syslog-ng]# cat syslog-ng.conf @version:3.5 @include "scl.conf" # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # Note: it also sources additional configuration files (*.conf) # located in /etc/syslog-ng/conf.d/ options { flush_lines (0); time_reopen (10); log_fifo_size (1000); chain_hostnames (off); use_dns (no); use_fqdn (no); owner("splunk"); group("splunk"); dir-owner("splunk"); dir-group("splunk"); create_dirs (yes); keep_hostname (yes); };     ## add Default 514 udp/tcp & Filtered based don't modify below line ############################################# # Syslog 514 #source s_syslog { udp(port(514)); tcp(port(514) keep-alive(yes)); }; source s_syslog518 { udp(port(518)); }; source s_syslog1513 { tcp(port(1513) keep-alive(yes)); }; source s_syslog1514 { tcp(port(1514) keep-alive(yes)); }; source s_syslog1515 { tcp(port(1515) keep-alive(yes)); }; source s_syslog1516 { tcp(port(1516) keep-alive(yes)); }; destination d_1513 { file("/splunksyslog/port1513/$HOST/syslog_$FACILITY_$YEAR-$MONTH-$DAY-$HOUR-$(/ $MIN 1).log");}; log { source(s_syslog1513); destination(d_1513); };   destination d_1514 { file("/splunksyslog/port1514/$HOST/syslog_$FACILITY_$YEAR-$MONTH-$DAY-$HOUR-$(/ $MIN 1).log");}; log { source(s_syslog1514); destination(d_1514); };   destination d_1515 { file("/splunksyslog/port1515/$HOST/syslog_$FACILITY_$YEAR-$MONTH-$DAY-$HOUR-$(/ $MIN 1).log");}; log { source(s_syslog1515); destination(d_1515); };   destination d_1516 { file("/splunksyslog/port1516/$HOST/syslog_$FACILITY_$YEAR-$MONTH-$DAY-$HOUR-$(/ $MIN 1).log");}; log { source(s_syslog1516); destination(d_1516); };   # destination d_catch { file("/splunksyslog/catch/$HOST/$YEAR-$MONTH-$DAY-$HOUR-catch.log");}; # log { source(s_syslog); destination(d_catch); };   destination d_518 { file("/splunksyslog/port518/$HOST/syslog_$FACILITY_$YEAR-$MONTH-$DAY-$HOUR-$(/ $MIN 1).log");}; log { source(s_syslog518); destination(d_518); }; @include "/etc/syslog-ng/conf.d/*.conf"   ... View more

we are looking for APP to get the domain reputation/creation data and if possible the sub domains  what APP is recommended  ... View more

we are using TA-MS_O365_Reporting and as part of the change Microsoft Change the TA should connect with token and not with user  in this TA I don't see such option   what is the alternative  ?  ... View more