About kprior201

kprior201 · ‎08-16-2024

Hey there! It sounds like you should have a deployment server (https://docs.splunk.com/Documentation/Splunk/9.3.0/Updating/Deploymentserverarchitecture) somewhere in the mix. The server classes mentioned should be controlled there. This should be different than the index cluster master. The universal forwarders get their configurations from the deployment server. You should be able to go into the deployment server and both see the configuration for this index as well as assign it to the appropriate server (once it has a deploymentclient.conf, at least). If you can find the deployment server, happy to help further.

kprior201 · ‎08-12-2024

Okay, so it looks like you're getting a list of dictionaries returned, so it shouldn't be too hard for us to figure this out. I'm not an expert code writer, by any means, but I've messed around with it enough to be able to troubleshoot at least, so I'll try to help. You should be able to do something like this where 'example' is the response from the previous call: for x in example: for k, v in x: if k == 'name': server_name = v url='https://su-ns-vpx-int-1.siteone.com/nitro/v1/config/lbvserver_servicegroup_binding/' + server_name <create API call here using new url>

kprior201 · ‎08-09-2024

Hello! If I'm understanding you right (and assuming you're using requests), you should be able to assign your API call to a variable and then call the variable.content in order to access what the results from the call are. The below, when I tested it, returned a dictionary of the results. From there, you should be able to parse out the variable that you're reassigning. Example: req = requests.post(url, json=payload, headers=headers) data = requests.content

kprior201 · ‎06-25-2024

Sorry for the delay on this; no, I don't really have an answer to that one. You might open a support ticket for advice there. In my instances, I generally tried to minimize the amount of events it was being sent.

kprior201 · ‎05-30-2024

Sure, you have a couple of options there. You can either add adaptive response actions to your Splunk ES correlation searches (if you're using those) or you can set up a saved search to export exactly the results you want to. When I last worked on this (it's been about a year), I found that the saved search method was more reliable. I used a search similar to the Incident Response view search ("Incident Review - Main" in SA-ThreatIntelligence) as my use case was to forward notable events to the SOAR platform.

kprior201 · ‎05-28-2024

This is a pretty big question. I would recommend you start here: https://docs.splunk.com/Documentation/SOARExport/4.3.2/UserGuide/Configureoverview for how to connect Splunk and Splunk SOAR. From there, you'll need to set up the mechanism for sending alerts to SOAR and a playbook within SOAR for processing them the way you need to. What action you want to do on the endpoint will determine how to set that playbook up. If this is leveraging Defender, for example, you can set up an action to call Defender to quarantine an endpoint or something like that. It will vary a lot depending on your exact use case.

kprior201 · ‎05-28-2024

Never did get this to work right, but a colleague came up with a different way of doing it which worked. Rather than using annotations, he factored it into the single search: `index` | eval risk=round(Risk_Score,0) | stats dc(System_Name) AS count by risk | sort + risk | join type=left [ search `index` | search System_Name="$system_name$" | eval risk=round(Risk_Score,0) | stats sum(risk) as highlight] | eval highlight=if(highlight=risk,highlight,0) | eval highlight=if(highlight=risk,count,0) | eval count=if(highlight=count,0,count)

kprior201 · ‎05-21-2024

Hello! I am having an issue getting annotations to work within the Dashboard Studio column chart. I have tried a bunch of different ways, but it isn't cooperating. The chart I have is just System_Name on the X axis and Risk_Score on the Y axis. I'd like to be able to highlight where the System_Name in question shows up on the chart as annotation examples have demonstrated in the documentation. My current code for the chart is as follows. Does anyone have any suggestions as to what I'm doing wrong here? Chart itself: { "type": "splunk.column", "options": { "seriesColorsByField": {}, "annotationColor": "> annotation | seriesByIndex('2')", "annotationLabel": "> annotation | seriesByIndex('1')", "annotationX": "> annotation | seriesByIndex('0')", "legendDisplay": "off" }, "dataSources": { "primary": "ds_abUJLKDj", "annotation": "ds_YPQ3EYqR" }, "showProgressBar": false, "showLastUpdated": false, "context": {} } Searches: "ds_abUJLKDj": { "type": "ds.search", "options": { "query": "`index` \n| stats latest(Risk_Score) AS Risk_Score by System_Name\n| eval Risk_Score=round(Risk_Score, 2)\n| sort Risk_Score" }, "name": "risk_score_chart" }, "ds_YPQ3EYqR": { "type": "ds.search", "options": { "query": "`index` \n| stats latest(Risk_Score) AS Risk_Score by System_Name\n| eval Risk_Score=round(Risk_Score, 2), color=\"#f44336\", Annotation_Label= (\"The risk score for $system_name$ is \" + Risk_Score) \n| sort Risk_Score\n| where System_Name = \"$system_name$\"\n| table System_Name, Annotation_Label, color" }, "name": "risk_score_chart_annotation"

kprior201 · ‎05-07-2024

I would check that the saved search populating the forwarder table in MC is finding the results as expected. Maybe the logs aren't making it from those forwarders that are missing? If you followed the setup instructions below, I don't think you're missing anything glaringly obvious. Saved search and setup information: https://docs.splunk.com/Documentation/Splunk/9.2.1/DMC/Configureforwardermonitoring

kprior201 · ‎05-06-2024

It's possible that your SH isn't set up to reach your LDAP systems and that's why it's not returning results, but it's hard to say without more information. I'd recommend checking the logs for the add-on and seeing if you can find any errors or anything in there. You'll find these in $SPLUNK_HOME/var/log/splunk/SA-ldapsearch.log (Ref: https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.8/User/UseSA-ldapsearchtotroubleshootproblems)

kprior201 · ‎05-03-2024

I'm not sure I fully understand what's going on here. When you run the |ldapsearch search="(objectClass=group)" attrs="*" | collect index=<ldapsearch> command on your forwarder, do you get results or an error message? If you get results, then you should be able to simply search against the index on your search head. If you don't get results, then there's something else going on: is the app configured correctly? is the query correct?

kprior201 · ‎04-30-2024

Is there a chance that a field parsing listed in the second half of the search is not shared within the app/globally? That is the first thing that I would check - make sure all of the variables listed are shared and that the non-admin role has access to the app in which they are shared.

kprior201 · ‎04-30-2024

Hello! 1. You're on the right track. https://splunkbase.splunk.com/app/1151 is what you need to be using. The documentation for this add-on has information about how the ldapsearch part works. You can run ldapsearch commands via the command line of wherever this is configured. If you're wanting to import certain ldap data, you'll need to create scheduled searches (on the HFW) to pull that data into Splunk. Read through https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.8/User/AbouttheSplunkSupportingAdd-onforActiveDirectory to get a good background on how to do that. 2. Yes, this is possible. The easiest way to do this is probably just to separate the data into different indexes using the collect command. Whatever data you want user1 to have, run a query for that data and collect to a certain index. Whatever data you want user2 to have, run a separate query to collect to a different index. There are other ways to do this as well, but that's the simplest I could think of.

kprior201 · ‎04-29-2024

Hello! You are not required to use data models or CIM compliance in correlation searches, so that isn't the issue here. Just to verify: If you copy/paste this exact search into a regular search bar, it will find results? If that is the case, here's what I would check: - Is it looking back the same amount of time? Make sure your correlation search is using the same look back as your manual search. - Are you executing the search within the Enterprise Security app when you are testing? If not, try it there. If the results don't return within the Enterprise Security app but they do within a different app, it could be a permissions/sharing setting for field parsings.

kprior201 · ‎04-11-2024

These lookups get their information from configured asset lookups within Enterprise Security, as you linked. They're populated automatically Do your asset lookups have CIDR information included in them? If the string lookup is populating, then you have some kind of assets configured. If you have a dev environment experiencing this problem, you might try enabling the demo_asset_lookup in the Asset and Identity Management page to see if it populates the CIDR one automatically. It has CIDR networks properly built into it. The best official documentation I came across in my search was https://docs.splunk.com/Documentation/ES/7.3.1/Admin/Howassetandidentitydataprocessed

kprior201 · ‎04-11-2024

If the KVStore initialization has failed, you'll definitely have a lot of issues. You'll need to figure out why that is by looking through $SPLUNK_HOME/var/log/splunk/mongod.log to see what's going on there and address it first.

kprior201 · ‎04-11-2024

I'd recommend seeing if your home router/firewall can stream syslog and setting up a forwarder to ingest those logs regularly. Install a forwarder on your PC and monitor your windows/linux/whatever you use logs that way as well. I think that would be a good start for messing around with data, at least. Also, check out https://www.splunk.com/en_us/training/course-catalog.html?sort=Newest&filters=filterGroup1FreeCourses if you haven't. There's lots of good content there for beginners.

kprior201 · ‎04-11-2024

I don't believe it is enabled for Cloud Trials: https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/RESTTUT/RESTandCloud

kprior201 · ‎04-11-2024

The base instructions here should be all you need to follow for that one. Review the rest of the 'planning' and 'securing' sections of that documentation to see any additional details you might be curious about, though.

kprior201 · ‎01-25-2024

Anytime there's a large amount of alerts or data, you just have to find a way to summarize it and then break it apart and focus on one thing at a time to see what is actually going on. I'd start by reviewing what signatures are coming in. Is it a majority of certain types? Is that type actually a concern in your environment? Are these alerts actually things that are concerning or is something set up strangely on the firewall? You will likely need to work with the firewall team to ensure that the threat detections on their side are set up in a useful way and you're not getting alerts for expected traffic. So, lots of things to do here, but start by breaking down the information into chunks. I'd focus on types of signatures and known assets/networks.

kprior201 · ‎01-25-2024

As far as I know, this isn't a feature that's available built in. However, you can make dashboards about it using the notable index. https://lantern.splunk.com/?title=Security%2FUCE%2FPrioritized_Actions%2FCyber_frameworks%2FAssessing_and_expanding_MITRE_ATT%26CK_coverage_in_Splunk_Enterprise_Security outlines some searches that would help you gather that information.

Posts	21
Solutions	3
Karma Given	4
Karma Received	11
Member Since	‎10-04-2018

Online Status	Offline
Date Last Visited	‎08-29-2024 12:13 PM

Emphasizing a result within a Column Chart

Re: Change server location for an index

Re: Is it possible to chain API calls so I can use...

Re: Is it possible to chain API calls so I can use...

Re: set up SOAR to receive data and send an action...

Re: set up SOAR to receive data and send an action...

Re: set up SOAR to receive data and send an action...

Re: Emphasizing a result within a Column Chart

Emphasizing a result within a Column Chart

Re: Deployment Clients not showing in Monitoring C...

Re: test AD environment

Re: test AD environment

Re: role problem

Re: Access model in the test AD environment

Re: Splunk ES Email alert and notable events are n...

Re: Why is assets_by_cidr.csv lookup file empty?

Re: Hunting an APT with Splunk - Reconnaissance

Re: Streaming data into Splunk for Analytics

Re: Why i am not able to use ACS services on Splun...

Re: Installing Splunk 9.1.1 on RHEL 9.3

Re: IPS/IDS use cases

Re: MITRE ATT&CK Posture for Enterprise Security N...