Hi, I try to figure this out for a week now and I am stucked. I installed the Microsoft 365 Defender Add-on for Splunk, which is the official supported TA referring to the Microsoft Partner docs. I enabled the input for endpoint alerts and excepted the TA to index all alerts since the "start time" (2 weeks ago). But only one event was send, the earliest event in the 14 days period. So in my case an event from 6/9/2021, the input was enabled on 23rd of June. Splin internal is only telling me that the connection was successfull ( status 200) and how long it took. I double checked all the siem intergration docs from microsoft , like what permissions need to be set and so on. Here is the link https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-hello-world?view=o365-worldwide Does anyone know, if there are more options in azure that need to be turned on to make it more talkativ? In Defender itself I can see way more alerts than 1 in the last 14 days. Thank you ... View more

Hi,  I would like to send aternity data to splunk and I was wondering if anyone here has done this before, because I can´t find a documentation on it. I am not familiar with the product or any api or what ever option there might be. I found that there is an splunk app for aternity https://splunkbase.splunk.com/app/4682/ but this is just for dashboards and a TA (https://splunkbase.splunk.com/app/1140/) which is just providing some props and transforms, but no input. There is also something called "Cloud-Native Integration for Riverbed APM"( http://portal.it-squared.net/wp-content/uploads/2019/08/Splunk-and-IT-Squared-Cloud-Native-Integration-for-Riverbed-APM-Documentation.pdf ) which could use HEC, but I can´t find how to set this up, its just stating "Once Splunk is configured follow the IT Squared / Cloud-Native Integration for Riverbed APM documentation to deploy it and set up data ingestion into Splunk." Another hint was, that the agents store the data in databases, so there might be a way to get the data with DB Connect, but thats the last option I want to consider. Any help or hint is highly appreciated Thank you David ... View more

HI fellow splunkies, and a good to to you, I would like to know if following is possible: Data base is historic data in a csv file. Total timerange of this data is two minutes. Is it possible to show this data on a dashboard panel and make it look like it´s real time data? Its for a demo and I would like the data to flow in "realtime", during a time period of 2 minutes until all the data from the csv file is read. I hope that somehow made sense. Maybe an example could clarify that a bit more: Lets assume we have a video of a car accelerating form 0 to 60, and this is happining because we have a real shitty car, in 2 minutes. As an overlay I would like to show the historic data of this acceleration in "real time" during the vid. I appreciate any kind of idea 🙂 Thank you David ... View more

Hi everyone, I was wondering if anyone here has got a wide range of experience in administrating and maintaining a healthy splunk environment, and would be willing to share some of his/hers best practises. I just want to learn more about how to keep splunk healthy. Besides the MC (Monitoring Console) and several alerts to reoccurring issues, what do you do on a daily basis, or what did you automated to make sure your environment (costumer environment) is running healthy? I recently discovered trackme, an app that really helps with the pain of data sources suddendly missing. (https://splunkbase.splunk.com/app/4621/) Are there any other helpful apps that you would recommend for this kind of purpose? All kind of ideas/hints are appreciated. Thank you Kind Regards David ... View more

HI, I trying to run the SercurityScoreard App on Splunk Version 7.2.3 and I am running into the issue that the app is not displaying its own view, but randomly the views of other apps. To make this clear, the whole navbar is from another app. Its kind of impersonating other apps. What I tried so far: • Checked if this is a cookie problem (set wrong cookie while app loading) : both apps don’t use a specific cookie - No problems. • Disabled the falsely displayed app, Scorecard app just switched to the views of a third app. • I have checked the Java version: Looks fine for me [SH glo-sa-logmaster@em1sclm002:/opt/splunk]$ java -version java version "1.8.0_201" Java(TM) SE Runtime Environment (build 1.8.0_201-b09) Java HotSpot(TM) 64-Bit Server VM (build 25.201-b09, mixed mode) • With the internal Logs I can definitely say that the java process does not generate the navigation files. Splunk takes the “next best app” with local/data/ui/nav/default.xml • I have tried to force loading the GUI with the default path (which should normally generically generated) . Therefore I have added the theatrically generated file/folder /opt/splunk/etc/apps/SecurityScorecard/local/data/ui/nav/default.xml No success. • Reinstalling the app (including “uninstalling “, restart, installing) did not change anything. • I have tried calling the jar manually ( /opt/splunk/etc/apps/SecurityScorecard/jars/SecurityScorecard.jar – no success, no output • The jar seems not to have a logging, so I cannot figure out what the problem is – it’s a black box. Are there any know issues? did anyone ran into the same problem? even with another app maybe? Thank you ... View more