Good Day, Perhaps one of you may be able to provide some clarity in regard to a Symantec Datasets – Lookup. In my environment, the symantec_ep_malware_category_lookup contains 18,169 results. This lookup contains a handful of fields, the field in question is: riskLevel. The 18,169 results are divided into three levels: Low, Very Low, and Moderate. The question: Why are there no results with a riskLevel of High, Very High, or Critical? I am misunderstanding the idea of this lookup? Question 2: Anyone able to point me to documentation where I can better research for myself? Thank you in advance. ... View more

Community, New to Splunk, first post, your patience is appreciated. Also, thank you in advance. This post is focused in the direction of efficiency, effectiveness, accuracy, and understanding rather than “How to.” I have three queries, each created by a different entity and I am seeking to understand the difference in Results and to understand the “What’s happening under the hood” of the queries themselves. Splunk provided consultant’s Report: tag=authentication action=failure user !="$" | table _time src dest user | rename src as "Source Machine" dest as "Destination Machine" | stats count as Failure_Count by user | where count > 50 | sort – count Comment: 4 hour window, Run Time: 51 minutes, does not appear to complete fully. It is as if the search continues looking for the newest events and adds those to the results. In-house created Report: sourcetype="WinEventLog:Security" EventCode=4625 user !="$" | table _time src dest user | rename src as "Source Machine" dest as "Destination Machine" | stats count as Failure_Count by user | sort - Failure_Count | where Failure_Count > 50 Comment: 24 hour window, Run Time: less than 30 seconds. However this yields thousands of Event Code: 4625 events per identified user, yet the results do not match the number of user account lockouts. Research shows that 90%+ of these events are to a server rather than Active Directory. Hence, no account lockouts I’d wager. Dashboard Panel from Splunk App for Windows Infrastructure: eventtype=msad-failed-user-logons (host="") |fields signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type,host | join max=0 host [ | search eventtype=msad-dc-health (ForestName="") (Site="") (DomainDNSName="") | dedup host | table host] | ip-to-host |stats count by user,src_nt_domain|sort -count|rename user as "Username", src_nt_domain as "Domain" Comment: 24 hour window, Run Time: 3:39 seconds and yielded roughly 200 events, which appear to match the user account lockout numbers. The Windows Infrastructure version uses the “eventtype.” Where did this come from? It is clear that there is different methodology, and accuracy, in each of these queries. What I do not understand is what exactly the Windows Infrastructure version is doing. There is a lot of documentation, examples, webinars, and comments, even within this forum which indicate to use the Index and Sourcetype to narrow the search criteria. ... View more