Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ch1221
ch1221
Path Finder
Member since:
06-20-2011
02-09-2023
Community Statistics
| Posts | 26 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 2 |
| Member Since | 06-20-2011 |
Activity Feed
- Got Karma for Lookup Editor app not showing new field added. 04-05-2022 06:46 AM
- Posted Re: Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 09:26 AM
- Posted Re: Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 08:44 AM
- Posted Re: Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 08:31 AM
- Posted Re: Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 08:22 AM
- Posted Re: Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 07:32 AM
- Posted Re: Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 07:24 AM
- Posted Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 06:44 AM
- Tagged Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 06:44 AM
- Tagged Alternatives to using MVExpand - running into limitations on Splunk Enterprise. 02-26-2021 06:44 AM
- Posted Re: Way to search ES Investigations for artifact or IOC? on Splunk Enterprise Security. 02-26-2021 06:38 AM
- Posted Re: Way to search ES Investigations for artifact or IOC? on Splunk Enterprise Security. 02-26-2021 06:34 AM
- Posted Lookup Editor app not showing new field added on All Apps and Add-ons. 02-09-2021 12:21 PM
- Tagged Lookup Editor app not showing new field added on All Apps and Add-ons. 02-09-2021 12:21 PM
- Tagged Lookup Editor app not showing new field added on All Apps and Add-ons. 02-09-2021 12:21 PM
- Tagged Lookup Editor app not showing new field added on All Apps and Add-ons. 02-09-2021 12:21 PM
- Posted Re: DECRYPT - Error in 'decrypt' command: External search command exited unexpectedly with non-zero error code 1. on All Apps and Add-ons. 02-08-2021 05:40 AM
- Posted Way to search ES Investigations for artifact or IOC? on Splunk Enterprise Security. 02-05-2021 01:48 PM
- Tagged Way to search ES Investigations for artifact or IOC? on Splunk Enterprise Security. 02-05-2021 01:48 PM
- Posted DECRYPT - Error in 'decrypt' command: External search command exited unexpectedly with non-zero error code 1. on All Apps and Add-ons. 02-05-2021 01:09 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
02-26-2021
09:26 AM
Yes, that works!!!! Thank you so much for your help!!!
... View more
02-26-2021
08:44 AM
This still only provides the results as a list in 1 event instead of breaking them out.
... View more
02-26-2021
08:31 AM
Yes, steps returns 9056
... View more
02-26-2021
08:22 AM
I removed the additional fields so it's just member_dn. Here's a very small sample of the 9,000+ member_dn CN=ORW-EG-M480,OU=Win7,OU=xxx Workstations,OU=xxx,OU=Amer,DC=xxx,DC=xxx,DC=com CN=FRG-W10-SCH,OU=Win7,OU=xxx,OU=EMEA,DC=xxx,DC=xxx,DC=com CN=FRS-MARV-L,OU=Win7,OU=xxx,OU=EMEA,DC=mgc,DC=xxx,DC=com
... View more
02-26-2021
07:32 AM
Still only one system being returned 😞
... View more
02-26-2021
07:24 AM
unfortunately that only returns one system out of the group.
... View more
02-26-2021
06:44 AM
I'm looking for another way to run the search below and expand the computer field. This search is pulling systems belonging to a specific group in AD and then cleaning up the name from the member_dn field. It them puts it into a lookup table to use in ES. Mvexpand is running into limitations with memory and I cannot adjust it high enough to extract all of the values. |ldapsearch domain=default search="(&(objectclass=group)(cn=Eng_Computers))" | table cn,distinguishedName | ldapgroup| table cn,member_dn,member_type | rex field=member_dn "CN\=(?P<computer>[\w\-\_]+)(?=\,\w{2}\=)" |mvexpand computer |table computer | sort computer |outputlookup eng_systems.csv Suggestions are appreciated.
... View more
Labels
- Labels:
-
troubleshooting
02-26-2021
06:38 AM
Added as an Idea.
... View more
02-26-2021
06:34 AM
Yes, those notes or any threat detection in a notable associated to an investigation would be useful.
... View more
02-09-2021
12:21 PM
1 Karma
Running the latest release of Lookup Editor, I had an existing KVStore that I added a new field to via Lookup Table Definitions. I am able to see this via "| inputlookup <kvstorename>" . I am also able to add values to the new field. However, Lookup Editor will not display the new field. Any suggestions?
... View more
Labels
- Labels:
-
troubleshooting
02-08-2021
05:40 AM
DECRYPT 2.3.0
... View more
02-05-2021
01:48 PM
Is there a way to search all ES Investigations for a specific artifact or IOC that may be documented in the notes?
... View more
Labels
- Labels:
-
investigation
02-05-2021
01:09 PM
Trying to use the DECRYPT app and I keep getting an error. I have it installed in a SH cluster and commands.conf has local=true and there is no streaming setting so that should default to false so it doesn't run on the indexers. However, I'm still getting errors from the indexers "Streamed search execute failed because: Error in 'decrypt' command: External search command exited unexpectedly with non-zero error code 1" https://splunkbase.splunk.com/app/2655/ Any suggestions?
... View more
Labels
- Labels:
-
troubleshooting
05-12-2020
05:09 AM
The raw results that I provided was a sample of 103+ results which is too much to post.
... View more
05-12-2020
05:08 AM
That doesn't work. It returns 6 events (based on the tags it appears) with all of the other values identical.
... View more
05-12-2020
04:53 AM
{ "start": 0, "terms": [ "feed_id:14" ], "highlights": [], "total_results": 103, "filtered": {}, "facets": {}, "results": [ { "ipv4_count": 0, "description": "description of event", "tags": [ "threathunting", "hunting", "t1033", "discovery", "recon", "windows" ], "feed_id": 14, "timestamp": 1552664393, "feed_category": "xxx", "sha256_count": 0, "create_time": 1552664393, "link": "hxxps://xxx.xxx", "id": "565616", "query_count": 1, "is_deleted": false, "title": "test", "has_query": true, "iocs": { "query": [ { "index_type": "events", "search_query": "test query" } ] }, "is_ignored": false, "feed_name": "test feed", "md5_count": 0, "score": 65, "ipv6_count": 0, "domain_count": 0 }, ], "elapsed": 0.013309955596923828}
... View more
05-11-2020
01:52 PM
Looking for some assistance extracting all of the nested json values like the "results", "tags" and "iocs" in the screenshot. I've been trying to get spath and mvexpand to work for days but apparently I am not doing something right. Any help is appreciated.
... View more
03-27-2020
07:14 AM
1 Karma
Will the CB Response app be compatible with Splunk 8.x anytime soon?
Or does anyone have a workaround for errors that I'm seeing about it being unable to parse nav XML - Unicode strings with encoding declaration are not supported. Please use bytes input or XML fragments without declaration. Any help is appreciated.
... View more
07-31-2017
02:00 PM
Here is something similar to what I am working with. As you can see, it includes multiple events in the logs and once those can be separated out, combining the messages with transaction should be straightforward.
2017-06-22 00:00:32 1dNw6R-0004dN-VU <= [email protected] H=svr-xxx--01.xxx.genericg.com [99.99.99.999] P=esmtp K S=76706 [email protected]
2017-06-22 00:00:32 H=esa3.generic.iphmx.com [99.99.999.999] F= rejected RCPT : bounce_localunknown router forced verify failure
2017-06-22 00:00:32 1dNw6Q-0004bW-Im => [email protected] R=dnslookup T=remote_smtp H=mga14.xx.com.com [99.99.99.999] X=TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256 CV=yes C="250 ok: Message 227984017 accepted"
2017-06-22 00:00:32 1dNw6Q-0004bW-Im -> [email protected] R=dnslookup T=remote_smtp H=mga14.xx.com.com [99.99.99.99] X=TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256 CV=yes C="250 ok: Message 227984017 accepted"
2017-06-22 00:00:32 1dNw6Q-0004bW-Im -> [email protected] R=dnslookup T=remote_smtp H=mga14.xx.com.com [99.99.99.999] X=TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256 CV=yes C="250 ok: Message 227984017 accepted"
2017-06-22 00:00:32 1dNw6Q-0004bW-Im -> [email protected] R=dnslookup T=remote_smtp H=mga14.xx.com.com [99.99.99.999] X=TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256 CV=yes C="250 ok: Message 227984017 accepted"
2017-06-22 00:00:32 1dNw6Q-0004bW-Im Completed
2017-06-22 00:00:32 1dNw6R-0004dN-VU => [email protected] R=dnslookup T=remote_smtp H=aspmx.l.gxxx.com [99.99.99.999] X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=yes K C="250 2.0.0 OK g6si645764iof.8 - gsmtp"
2017-06-22 00:00:32 1dNw6R-0004dN-VU Completed
2017-06-22 00:00:33 no IP address found for host aj.to.genericg.com (during SMTP connection from es3.generic.iphmx.com [99.99.999.999])
2017-06-22 00:00:33 H=esa3.generic.iphmx.com [99.99.999.999] X=TLSv1.2:RC4-SHA:128 CV=no F= temporarily rejected RCPT : lookup of host "aj.to.generic.com" failed in xxx_routes router
2017-06-22 00:00:34 1dNw6U-0004dl-Ia <= [email protected] H=esa2.generic.iphmx.com [99.99.99.99] P=esmtps X=TLSv1.2:RC4-SHA:128 CV=no S=12467 [email protected]
2017-06-22 00:00:35 1dNw6U-0004dl-Ia => [email protected] R=exchange_users T=remote_smtp_ex_hosts H=mail-na.genericg.com [99.99.999.999] X=TLSv1:ECDHE-RSA-AES256-SHA:256 CV=yes K C="250 2.6.0 <[email protected]> [InternalId=5521513] Queued mail for delivery"
2017-06-22 00:00:35 1dNw6U-0004dl-Ia Completed
... View more
07-31-2017
07:58 AM
I'm trying to get Exim logs parsed into Splunk to log inbound/outbound mail. I'm very new using RegEx and have been fighting to get something to parse it correctly. I've tried field-extractor and it only grabs about 13%, I've also tried the add-on builder.
Has anyone successfully consumed Exim logs? Can you provide some help?
... View more
- Tags:
- splunk-enterprise
01-27-2017
02:01 PM
I have data being fed into Splunk from a log file in json format. Currently it is not extracting any of the fields from below. Any suggestions on how to get this parsed correctly? I am fairly new to this. Thanks in advance.
1 2017-01-27T13:36:36.95-08:00 SERVER Malwarebytes-Endpoint-Security 1848 - - {\"security_log\":{\"client_id\":\"16041d03-c24a-4d75-a4e8-592923cff7f0\",\"host_name\":\"XXX-WIN7-X64-2\",\"domain\":\"xxx.xxx.com\",\"mac_address\":\"00-0C-29-xx-xx-xx\",\"ip_address\":\"xxx.xxx.xxx.xx\",\"time\":\"2017-01-27T13:36:32-08:00\",\"threat_level\":\"Moderate\",\"object_type\":\"FileSystem\",\"object\":\"C:\\\\Users\\\\user\\\\AppData\\\\LocalLow\\\\AskToolbar\\\\cache.dat\",\"threat_name\":\"PUP.Optional.ASK\",\"action\":\"Quarantine\",\"operation\":\"QUARANTINE\",\"resolved\":true,\"logon_user\":\"\",\"data\":\"data\",\"description\":\"No description\",\"source\":\"MBAM\",\"payload\":null,\"payload_url\":null,\"payload_process\":null,\"application_path\":null,\"application\":null}}
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-09-2023
04:38 PM
|
