Bump ... View more

A curl based example is available here: https://docs.splunk.com/Documentation/ES/latest/API/NotableEventAPIreference I'd reference that doc and leave comments on the doc page if you still run into issues. ... View more

@stroud_bc - depending on the version of ES you're running we optimized some of the merge code recently, but if any of the "key" fields match across rows we would squash that record into one by default. That said, we noticed some source lookup files were filling in "null" values with strings which caused inadvertant merges. Double check that any of the key fields (nt_host, ip, mac and dns) indeed have empty strings rather than placeholder values like "n/a", "none", etc. ... View more

@malcolmce and @luongg - thank you for the candid feedback, we're actually working through some updates to both the Auth DM as well as the AWS TA. We'll be sure to provide some guidance on this in the next week or so, but it's certainly a case we will account for as we make the updates. ... View more

I'd start with the Malware Datamodel: https://docs.splunk.com/Documentation/CIM/4.14.0/User/Malware ... View more

It looks like you're using add-on builder to make the AR action. It could be something internal to the helper class in AoB. The "get_param()" method used to be purely for pulling values specified in alert_actions.conf, not from the raw events themselves. https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/PythonHelperFunctions To pull the actual values from the event, you could follow the sample pattern as follows: events = helper.get_events() for event in events: ro = event['risk_object'] ... View more

ES has a threat intel framework you can use to onboard the data: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/threatintelligenceframework/ I'm not entirely familiar with how IBM exposes their threat feed, but the ES framework is very robust and should be pretty straightforward to do. ... View more

What version of Splunk Enterprise? Just b/c it's clean doesn't indicate what version you are trying to install ES 6.0 on. Also, as far as I can tell, there was an issue retrieving the session key during the install process. It may mean the install took a very long amount of time and the session key became invalid. The install process should be pretty quick, was it left alone for a while before or after you selected what TAs you wanted to install? ... View more

Is this an upgrade or net-new ES install? What version of Splunk Enterprise? You can always check the _internal logs, as Splunk logs the upgrade in $SPLUNKHOME$/var/log/splunk/essinstaller2.log, so youc an search something like index=_internal source=*/essinstaller2.log ... View more

It's a bit hard to make out based on the formatting, but it looks to me like whatever sources or sourcetypes that are in in the eventtype search "opsec_communicate" is what's missing here...that said it looks like your local overrides for check_point_action eventtype should work, but in any case, if you can get tag=network or tag=communicate to actually return results for action=allowed, that will fix the DM problem. ... View more

You may want to ensure that the tags.conf for checkpoint also is pointing to that eventtype you mention (check_point) for: tag=network tag=communicate. As an example tags.conf: [eventtype=check_point] network = enabled communicate = enabled A quick litmus test would be to just run a search with something like: "tag=network OR tag=communicate | stats values(action) by sourcetype" ... View more

ES, on versions prior to 5.3, used a feature called "app imports". You need to add the app's name (as it appears on disk in etc/apps) to the app imports regex - documentation is here: https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#Import_add-ons_with_a_different_naming_convention This is also documented with Enterprise Security Content Updates: https://docs.splunk.com/Documentation/ESSOC/1.0.38/user/ConfigureMLTKforusewithES ... View more

There are these examples in docs: http://docs.splunk.com/Documentation/ES/5.2.0/User/RiskScoring The appendpipe option is pretty good, but that said multiple | sendalert s should be supported as well - what version of ES are you on? ... View more

Do you happen to know which version of ES the client upgraded from? As well as the underlying Splunk version they upgraded from and to as well? ... View more

This is likely due to app-imports-update mod input not configured to accept the OpenLDAP app name: https://docs.splunk.com/Documentation/ES/5.1.0/Install/ImportCustomApps ... View more

Hey Benjamin, I believe this macro is what populates the "Adaptive Responses" area of a Notable event when you expand it in incident review. It should be a fairly fast/narrow search and should only be invoked when you expand a particular notable in incident review. For reference, here's the macro defintion: tstats allow_old_summaries=true latest(Modular_Actions.action_status) as action_status from datamodel=Splunk_Audit.Modular_Actions where Modular_Actions.action_name!="unknown" (Modular_Actions.sid=$sid$ Modular_Actions.rid=$rid$) OR (Modular_Actions.orig_sid=$sid$ Modular_Actions.orig_rid=$rid$) by _time,nodename,Modular_Actions.action_name,Modular_Actions.sid,Modular_Actions.rid,Modular_Actions.action_mode,Modular_Actions.user span=1s | `drop_dm_object_name("Modular_Actions")` | eventstats latest(action_status) as action_status by action_name,sid,rid | search nodename="Modular_Actions.Modular_Action_Invocations" | sort 0 -_time | join type=outer action_name [| rest splunk_server=local count=0 /services/alerts/alert_actions | spath input=param._cam path=drilldown_uri output=action_drilldown_uri | rename title as action_name,label as action_label | fields action_name,action_label,action_drilldown_uri] | eval action_label=if(isnotnull(action_label),action_label,action_name),epoch_time=_time | fields _time,epoch_time,action_status,action_name,action_label,action_mode,action_drilldown_uri,sid,rid,user ... View more

Hello @AlexeySh - while I don't have any recommendations for free malware domain lists (hopefully others will chime in). That said, do you have some examples of false positives that are on the list that are showing up? ... View more

Symantec has some constraints on hosting integrations that they wrote on Splunkbase (or other "3rd party" sites). If you work with your Symantec SE and rep, they can help get you access to the TA and Apps. ... View more

You're totally right, I did't check my work closely enough - there's a few things on the capture group for the O,OU,S, etc that are easy to fix - let me see if I can work out something for the other items. ... View more