Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About evelenke
evelenke
Contributor
Member since:
03-23-2014
12-05-2021
Community Statistics
| Posts | 122 |
| Solutions | 4 |
| Karma Given | 11 |
| Karma Received | 15 |
| Member Since | 03-23-2014 |
Activity Feed
- Got Karma for Missed macro ec2_excessive_terminateinstances_mltk_input_filter. 02-21-2023 06:22 PM
- Posted Missed macro ec2_excessive_terminateinstances_mltk_input_filter on Splunk Enterprise Security. 04-08-2021 04:19 AM
- Posted Re: How to audit changes in Splunk objects (Git or else)? on Monitoring Splunk. 08-14-2020 02:58 AM
- Posted How to audit changes in Splunk objects (Git or else)? on Monitoring Splunk. 08-10-2020 01:28 AM
- Got Karma for Re: How to return a single value from a subsearch into eval. 07-23-2020 12:20 PM
- Posted Re: Any chance of filtering out a field for the particular role? on Splunk Enterprise Security. 07-08-2020 10:08 AM
- Karma Re: Any chance of filtering out a field for the particular role? for richgalloway. 07-08-2020 10:05 AM
- Posted Re: Any chance of filtering out a field for the particular role? on Splunk Enterprise Security. 07-08-2020 06:59 AM
- Posted Re: Any chance of filtering out a field for the particular role? on Splunk Enterprise Security. 07-07-2020 11:14 PM
- Karma Re: Any chance of filtering out a field for the particular role? for _gkollias. 07-07-2020 11:14 PM
- Posted Any chance of filtering out a field for the particular role? on Splunk Enterprise Security. 07-07-2020 02:38 PM
- Karma Re: How to add a PC name to a threat intel list for Splunk Enterprise Security? for alonsocaio. 06-05-2020 12:51 AM
- Karma Re: How to add a PC name to a threat intel list for Splunk Enterprise Security? for alonsocaio. 06-05-2020 12:51 AM
- Got Karma for How to avoid mixng values of assets by 'entitymerge' command in ES. 06-05-2020 12:51 AM
- Got Karma for Splunk Integartion mApp for Cherwell is unavailable. 06-05-2020 12:50 AM
- Got Karma for Splunk Integartion mApp for Cherwell is unavailable. 06-05-2020 12:50 AM
- Got Karma for Why only one condition works for where clause in a tstats search. 06-05-2020 12:50 AM
- Got Karma for Moving files and folders inputs to heavy forwarder. 06-05-2020 12:50 AM
- Got Karma for How to add email action into Adaptive Response in ES. 06-05-2020 12:50 AM
- Karma Re: Sourcetype overriding works but strange for p_gurav. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
04-08-2021
04:19 AM
1 Karma
Hi Splunkers, in ES Content Update there's detection rule that requires a prebuild MLTK model that is formed by a search "ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK". And the search uses macro ec2_excessive_terminateinstances_mltk_input_filter , that can not be found neither in ESCU nor other apps. Is it more a Support case or someone may help with this macro?
... View more
Labels
08-14-2020
02:58 AM
Hi, so you say "_audit index is your friend for this" , but in the answer you'd proposed me the very first sentence is "It's already been determined that alarms/reports modifications are not being audited in _audit and _internal indexes." . 🙂 Thanks anyway!
... View more
08-10-2020
01:28 AM
Hi Splunkers, we need to monitor who, when, where and what was changed in macros, searches and so on. Internal index can answer to "who, when, where" (audit POST requests). Which is the right and preferred way to answer to "what" exactly was added or removed to/from the knowledge object during the change operation. P.S. We have to have this information in Splunk and correlate with _internal audit
... View more
Labels
- Labels:
-
audit
-
search head
07-08-2020
10:08 AM
I accept this message, because it has the most convenient approach - use of CLONE_SOURCETYPE. As a result I have the same data in a single index but in 2 sourcetype, one of them with masked data and restriction filter for guest role "sourcetype=data_masked"
... View more
07-08-2020
06:59 AM
I may use restrictions for the role - limit by sourcetype
... View more
07-07-2020
11:14 PM
Do I understand correctly, that using CLONE_SOURCETYPE will allow me to forward masked data to the same index but separate sourcetype and filter with restrictions of the role (sourcetype=clone) ? Will inputs work like this or do I need to use new index anyway as the source is the same?
... View more
- Tags:
- rstand correctly
07-07-2020
02:38 PM
Hi Splunkers, need to keep some sensitive data in index, but hide it for some roles. Is there any way to do this and if not - is it on plans?
... View more
Labels
- Labels:
-
administration
05-25-2020
12:03 PM
Hi alonsocaio,
thank you for reply.
This is just a local name without any domain.
To be honest I did not examine all correlation searches on methods them correlate with intel tables, hence my question was brought up.
Also I'm in doubt it can compare lists with untypical field (not src, ip, user or other CIM-described field) .
So the idea with custom search that will parse data for a equality looks more appropriate to me as well.
... View more
05-25-2020
10:36 AM
Hi Splunkers,
We have an indicator of a phishing source from email headers - a PC name. We need to add it to a Threat Intel collection for ES.
I did not find an appropriate one to use. Should we create a custom list or would any of the pre-existing ollections work with it?
... View more
Labels
04-15-2020
05:32 AM
I believe in previous versions empty values were replaced with "unknown"?
... View more
04-15-2020
05:14 AM
1 Karma
Hi Splunkers ,
any advice how to avoid mixng values in assets by entitymerge command?
I have 5 fileds marked as Multivalue (category, ip, mac) and sometimes it cause trouble like multiple assets mapped to all existing categories or multiple IP addresses, and thus incorrect notable events.
Do I understand correctly that I should mark fields as Multivalue if there might be several valuse (like 2 mac addresses for computer or several categories (router|network) ?
SE V7.3.3, Enterprise Security Version 6.0.1 Build 2
... View more
02-07-2020
08:49 AM
Hi @gcusello ,
everything may be custom - You can set index, source and sourcetype in inputs.conf on UF or DB Connect.
In this case you may\should have a big knowledge base and control everything.
I need something more simplistic like IP addresses or actual hostname of a source where logs were delivered from, is there's any option to track this?
... View more
02-07-2020
08:48 AM
You can set index, source and sourcetype in inputs.conf on UF or DB Connect.
In this case you may\should have a big knowledge base and control everything.
I need something more simplistic like IP addresses or actual hostname of a source where logs were delivered from, is there's any option to track this?
... View more
02-06-2020
07:07 AM
Hi Splunkers,
we have centralized syslog collector.
Also many hosts deliver logs via UFs directly.
The same index may contain data delivered from UFs and from syslog inputs.
Also we have DB connectors and APIs.
Is it possible to divide data by type of input? Does Splunk have this kind of inspection?
... View more
01-24-2020
07:25 AM
1 Karma
Another hint ... | return $ip | format ]
... View more
01-14-2020
03:07 PM
HI,
sorry, I've figured out the problem - the reason of this is that at that day many of events for previous period was added to audit.
How should I handle this question correctly?
... View more
01-14-2020
09:27 AM
Hi Splunkers,
generally we use the approach to calculate license use for index by quering:
index="_internal" source="*metrics.log" group="per_index_thruput" series=myindex host=myindexer*
| stats sum(kb) as mb
| eval mb=mb/1024 .
But when we calculate it like a real raw size with
index=myindex
| eval mb=len(_raw)
| stats sum(mb) as mb
| eval mb=mb/1024/1024
we may have big difference, for example for one of indexes it is 4 Gb against 180mb!
Why is it so, please explain
... View more
09-17-2019
01:40 AM
Hi, did you resolve this?
... View more
08-06-2019
10:12 AM
Hi Mary,
thank you, that's a great example.
What I'm trying to say - with described add-on configuration you should not get any value for fields vendor_action and action on Search head, even if you have vendor_action in events.
I see you use condition AND match(lower('vendor_action') - does your 'vendor_action' field fulfilled with values?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-05-2021
08:21 AM
|
Karma given to
