Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ch1221
ch1221
Path Finder
Member since:
06-20-2011
02-09-2023
Community Statistics
| Posts | 26 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 2 |
| Member Since | 06-20-2011 |
Activity Feed
- Got Karma for Lookup Editor app not showing new field added. 04-05-2022 06:46 AM
- Posted Re: Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 09:26 AM
- Posted Re: Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 08:44 AM
- Posted Re: Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 08:31 AM
- Posted Re: Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 08:22 AM
- Posted Re: Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 07:32 AM
- Posted Re: Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 07:24 AM
- Posted Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 06:44 AM
- Tagged Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 06:44 AM
- Tagged Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 06:44 AM
- Posted Re: Way to search ES Investigations for artifact or IOC? on Splunk Enterprise Security. 02-26-2021 06:38 AM
- Posted Re: Way to search ES Investigations for artifact or IOC? on Splunk Enterprise Security. 02-26-2021 06:34 AM
- Posted Lookup Editor app not showing new field added on All Apps and Add-ons. 02-09-2021 12:21 PM
- Tagged Lookup Editor app not showing new field added on All Apps and Add-ons. 02-09-2021 12:21 PM
- Tagged Lookup Editor app not showing new field added on All Apps and Add-ons. 02-09-2021 12:21 PM
- Tagged Lookup Editor app not showing new field added on All Apps and Add-ons. 02-09-2021 12:21 PM
- Posted Re: DECRYPT - Error in 'decrypt' command: External search command exited unexpectedly with non-zero error code 1. on All Apps and Add-ons. 02-08-2021 05:40 AM
- Posted Way to search ES Investigations for artifact or IOC? on Splunk Enterprise Security. 02-05-2021 01:48 PM
- Tagged Way to search ES Investigations for artifact or IOC? on Splunk Enterprise Security. 02-05-2021 01:48 PM
- Posted DECRYPT - Error in 'decrypt' command: External search command exited unexpectedly with non-zero error code 1. on All Apps and Add-ons. 02-05-2021 01:09 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
02-26-2021
09:26 AM
Yes, that works!!!! Thank you so much for your help!!!
... View more
02-26-2021
08:44 AM
This still only provides the results as a list in 1 event instead of breaking them out.
... View more
02-26-2021
08:31 AM
Yes, steps returns 9056
... View more
02-26-2021
08:22 AM
I removed the additional fields so it's just member_dn. Here's a very small sample of the 9,000+ member_dn CN=ORW-EG-M480,OU=Win7,OU=xxx Workstations,OU=xxx,OU=Amer,DC=xxx,DC=xxx,DC=com CN=FRG-W10-SCH,OU=Win7,OU=xxx,OU=EMEA,DC=xxx,DC=xxx,DC=com CN=FRS-MARV-L,OU=Win7,OU=xxx,OU=EMEA,DC=mgc,DC=xxx,DC=com
... View more
02-26-2021
07:32 AM
Still only one system being returned 😞
... View more
02-26-2021
07:24 AM
unfortunately that only returns one system out of the group.
... View more
02-26-2021
06:44 AM
I'm looking for another way to run the search below and expand the computer field. This search is pulling systems belonging to a specific group in AD and then cleaning up the name from the member_dn field. It them puts it into a lookup table to use in ES. Mvexpand is running into limitations with memory and I cannot adjust it high enough to extract all of the values. |ldapsearch domain=default search="(&(objectclass=group)(cn=Eng_Computers))" | table cn,distinguishedName | ldapgroup| table cn,member_dn,member_type | rex field=member_dn "CN\=(?P<computer>[\w\-\_]+)(?=\,\w{2}\=)" |mvexpand computer |table computer | sort computer |outputlookup eng_systems.csv Suggestions are appreciated.
... View more
Labels
- Labels:
-
troubleshooting
02-26-2021
06:38 AM
Added as an Idea.
... View more
02-26-2021
06:34 AM
Yes, those notes or any threat detection in a notable associated to an investigation would be useful.
... View more
02-09-2021
12:21 PM
1 Karma
Running the latest release of Lookup Editor, I had an existing KVStore that I added a new field to via Lookup Table Definitions. I am able to see this via "| inputlookup <kvstorename>" . I am also able to add values to the new field. However, Lookup Editor will not display the new field. Any suggestions?
... View more
Labels
- Labels:
-
troubleshooting
02-08-2021
05:40 AM
DECRYPT 2.3.0
... View more
02-05-2021
01:48 PM
Is there a way to search all ES Investigations for a specific artifact or IOC that may be documented in the notes?
... View more
Labels
- Labels:
-
investigation
02-05-2021
01:09 PM
Trying to use the DECRYPT app and I keep getting an error. I have it installed in a SH cluster and commands.conf has local=true and there is no streaming setting so that should default to false so it doesn't run on the indexers. However, I'm still getting errors from the indexers "Streamed search execute failed because: Error in 'decrypt' command: External search command exited unexpectedly with non-zero error code 1" https://splunkbase.splunk.com/app/2655/ Any suggestions?
... View more
Labels
- Labels:
-
troubleshooting
01-07-2021
06:13 AM
Thanks for posting all of this information. I have made all of these changes and the ServiceNow admin has done the mapping, however when I try to adhoc invoke the incident creation I receive the following error: ""ServiceNow Incident Integration" could not be dispatched: ModularActionException: Invalid parameter for adhoc modular action" I've been struggling with this for days and cannot find a solution. Any ideas?
... View more
05-12-2020
05:09 AM
The raw results that I provided was a sample of 103+ results which is too much to post.
... View more
05-12-2020
05:08 AM
That doesn't work. It returns 6 events (based on the tags it appears) with all of the other values identical.
... View more
05-12-2020
04:53 AM
{ "start": 0, "terms": [ "feed_id:14" ], "highlights": [], "total_results": 103, "filtered": {}, "facets": {}, "results": [ { "ipv4_count": 0, "description": "description of event", "tags": [ "threathunting", "hunting", "t1033", "discovery", "recon", "windows" ], "feed_id": 14, "timestamp": 1552664393, "feed_category": "xxx", "sha256_count": 0, "create_time": 1552664393, "link": "hxxps://xxx.xxx", "id": "565616", "query_count": 1, "is_deleted": false, "title": "test", "has_query": true, "iocs": { "query": [ { "index_type": "events", "search_query": "test query" } ] }, "is_ignored": false, "feed_name": "test feed", "md5_count": 0, "score": 65, "ipv6_count": 0, "domain_count": 0 }, ], "elapsed": 0.013309955596923828}
... View more
05-11-2020
01:52 PM
Looking for some assistance extracting all of the nested json values like the "results", "tags" and "iocs" in the screenshot. I've been trying to get spath and mvexpand to work for days but apparently I am not doing something right. Any help is appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-09-2023
04:38 PM
|
