About barcher83

barcher83 · ‎10-07-2019

Thank you, yes 'category' field was not populated in our asset import. https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Formatassetoridentitylist

barcher83 · ‎10-02-2019

The ES correlation search 'DNS Query Requests Resolved by Unauthorized DNS Servers' determines if the traffic is to from and authorized name server by using the criteria: DNS.dest_category != dns_server AND DNS.src_category != dns_server from the 'Network Resolution (DNS) > DNS' Data model. In our environment the DNS Data Model is populated from events from Microsoft AD: Sourcetype MSAD:NT6:DNS however, dest_category and src_category are not populated by this app. Anyone know the appropriate way to inform ES of the authorized name servers?

barcher83 · ‎06-21-2019

Thank you! I added this to my local/props.conf file and it seems to be working EVAL-action = case(Operation=="UserLoggedIn", "success", Operation=="MailboxLogin", "success", Operation=="UserLoginFailed", "failure")

barcher83 · ‎06-16-2019

The Splunk Add-on for Microsoft Cloud Services is populating the Authentication datamodel in ES, however action="Unknown" for successful and failed logon events. Where would be a good place to start to look to correct this?

Posts	4
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎08-21-2018

Online Status	Offline
Date Last Visited	‎10-19-2021 10:00 AM

Defining Authorized Name Servers in ES

Splunk Add-on for Microsoft Cloud Services: action...

Re: Defining Authorized Name Servers in ES

Defining Authorized Name Servers in ES

Re: Splunk Add-on for Microsoft Cloud Services: ac...

Splunk Add-on for Microsoft Cloud Services: action...