This should be automatic - the source lookups (like the file you uploaded) should be automatically merged when a new file is added to the source lookups, or when those sources are modified. That said, we created a new "view" in ES to do all the management of the source lookups, it's called "ess_entity_management". Try to get to that page and ensure your lookups are showing up there, and configured for merge. That page has a tab in it called "Search Preview" that lets you force merge. The entire URI should look similar to the following (just prepend your info for your Splunk server and port): /en-US/app/SplunkEnterpriseSecuritySuite/ess_entity_management ... View more

Hello @ericl42 - there isn't a straightforward way to achieve what you're asking, with the current implementation of alert actions w/in Splunk Enterprise (this is what Adaptive Response is built on top of). Right now, all alert/adaptive response actions attached to a correlation search, run basically simultaneously. This means that things that are search-time constructs like the notable id (aka "rule_id") value that would be used to update the stats of a Notable, doesn't yet exist and is therefore not accessible to other AR actions being run. Your best bet is to set up an external saved search that looks for the "source" value of the notable(s) you want to auto-close, and attach your AR action to that saved search. This should allow you to access the value of "rule_id" from those search results and you can then operate on that notable as you see fit. ... View more

I'd start with props.conf in that addon, specifically the stanza [ms:o365:management]. It doesn't look like they have a field alias set up for action, and that datamodel uses a calculated field to set "unknown" for any events that don't have an explicit "action" field or explicit "action" value. As far as how to hunt this stuff down on your own, CIM usually leverages tag="some tag name" for its base search to pull events into a specific model. So normally, I look at tags.conf for the CIM datamodel I'm interested in, then look at the associated eventtype.conf that tags.conf pointed to. In this case, here's the eventtypes.conf: [mso365_authentication] search = sourcetype=ms:o365:management o365_audit_model_type=auth tags = authentication From there, just dig into the associated sourcetype in props for the same addon. ... View more

There's documentation here that has pretty solid detail: https://my.phantom.us/4.2/docs/admin/splunk sign up for an account at phantom.us - it's free. However, the TL;DR is, in order to export data via a data model search, you need datamodels defined in your Splunk instance/search head - those datamodels will then have "objects" in them which should "un-grey out" the "select object" field. If you want a quick test, install the Splunk Common Information Model (CIM) app on your Splunk instance. Restart splunk after install and see if the dropdown is still grey'd out. https://splunkbase.splunk.com/app/1621/ ... View more

It's supported on 7.2, however, there is more guidance here on best practices for working with GuardDuty data: https://www.splunk.com/blog/2018/02/22/serving-it-up-with-aws-and-splunk-aws-serverless-application-repository-now-available.html ... View more