About ericl42

smahoney · ‎03-15-2023

Not sure if you are still monitoring these, but I wanted to use this solution and compare the current count against the output of this query in a dashboard panel and its driving me nuts. So if the current hourly count is 5 at 6pm, compare it to the output of the 6PM average from this solution.

hettervik_new · ‎12-14-2022

Hi. There are a defined list of field names that will show up in Incident Review in Splunk ES. To get a new field added to that list, i.e. "unique_count", you must add it in the list "Incident Review - Event Attributes" under Configure > Incident Management > Incident Review Settings.

ErikA · ‎05-16-2022

Yes, this worked for me as well. Thanks!

ericl42 · ‎01-19-2021

Hello, I've ready a ton of forums posts regarding this but I still cannot get it to work so I'm hoping someone could point out what I'm doing wrong. The scenario I have is there are multiple hosts with the Splunk agent installed on it and we're currently logging that data to our Splunk indexers + a syslog server. For a short period of time, I want to send a subset of logs only to syslog but I can't seem to get that to work. Below is my current config on my heavy forwarders. I expect this to send all hosts with server* to Splunk and syslog but only endpoint* to syslog. Right now no matter what I do, everything still goes to Splunk. I even fully commented out the routeSubset section and "splunk reload deploy-server" and I still got those logs in Splunk Any thoughts would be greatly appreciated. props.conf [source::WinEventLog:Security] TRUNCATE = 0 SEDCMD-win = s/(?mis)(Token\sElevation\sType\sindicates|This\sevent\sis\sgenerated).*$//g TRANSFORMS-routing = routeSubset, routeSubset2 transforms.conf [routeSubset] SOURCE_KEY=MetaData:Host REGEX=(?i)^server[0-9][0-9].* DEST_KEY=_TCP_ROUTING FORMAT=splunkssl [routeSubset2] SOURCE_KEY=MetaData:Host REGEX=(?i)(.*endpoint[0-9][0-9].*|^server[0-9][0-9].*) DEST_KEY=_SYSLOG_ROUTING FORMAT=syslog_server

vulnfree · ‎12-29-2020

I have the same question. Any help?

ericl42 · ‎08-06-2020

I ended up going down the Event Hub route. You can use the Azure Diagnostic agent to push all Linux/Windows logs to EH and then use Microsoft Azure Add-on for Splunk to then ingest those logs into Splunk. This allows the traffic to not go over the VPN connection and just pay for back egress traffic outbound to Azure. Since it's SSL, it should do some encryption and save you a few costs. You can then modify the transforms and props files to help divide the logs up to the appropriate indexes and what not.

ericl42 · ‎12-18-2019

I've tried that as well and it still doesn't appear to be working. Code: events = helper.get_events() for event in events: print(event) risk_object = event.get("risk_object") helper.log_info("event.get(\"risk_object\")={}".format(risk_object)) risk_object_type = event.get("risk_object_type") helper.log_info("event.get(\"risk_object_type\")={}".format(risk_object_type)) risk_message = event.get("risk_message") helper.log_info("event.get(\"risk_message\")={}".format(risk_message)) Output: signature="event.get("risk_object_type")=None"

kchamplin_splun · ‎12-11-2019

Hello @ericl42 - there isn't a straightforward way to achieve what you're asking, with the current implementation of alert actions w/in Splunk Enterprise (this is what Adaptive Response is built on top of). Right now, all alert/adaptive response actions attached to a correlation search, run basically simultaneously. This means that things that are search-time constructs like the notable id (aka "rule_id") value that would be used to update the stats of a Notable, doesn't yet exist and is therefore not accessible to other AR actions being run. Your best bet is to set up an external saved search that looks for the "source" value of the notable(s) you want to auto-close, and attach your AR action to that saved search. This should allow you to access the value of "rule_id" from those search results and you can then operate on that notable as you see fit.

ericl42 · ‎11-26-2019

Thank you very much. Yesterday before this post I accidentally started testing with aligntime and it seemed to fix the issue but I wasn't 100% why. I don't think I can use sliding windows because I'm mocking all of these rules up for ES correlation searches.

David · ‎11-18-2019

Hello! The foundation of standard deviation-based detections is that you are pulling a large baseline, and in the case of these detections that you're looking at a per-entity baseline. E.g., comparing one src_ip to its own baseline, rather than any other src_ips in the organization. This is why you need a long baseline, because if you don't know what "normal" looks like you can't define what "abnormal" looks like. In your case, you probably want to compare a src_ip to all src_ips rather than comparing a src_ip to its own baseline. In that case, I would instead use the "Sources Sending Many DNS Requests" as a format rather than the standard time series, as it also looks over the short term (grouping by the hour) and compares across multiple different hosts. https://docs.splunksecurityessentials.com/content-detail/showcase_huge_volume_dns_requests/ Minor note: You're using the "demo data" version of the SSE queries rather than the live data version (the live data version doesn't use the eventstats). This minor, but swapping maxtime for now() and getting rid of that eventstats may make the search easier to follow. (Tried to build it out but having issues with the formatting here on SplunkBase. I can always email it to you.)

lakshman239 · ‎11-19-2019

for scenario 1, as you pointed, we could use get_events(). Lets assume, your correlation search returns 2 results. So, in that case events = helper.get_events() for event in events: helper.log_info("myevent={}.format(event)) So, you can get both the results which you can iterate through and take the dictionary object and/or parse it to select the field you need from the event to sent to ticketing system

solarboyz1 · ‎08-22-2019

So, if Bob is logged into Splunk, you want all correlation searches to pass Bob as the username to the adaptive response? I don't know of any way to accomplish that. | rest /services/authentication/current-context splunk_server=local Should only return the context of the user who ran the search, so if you added this to the correlation search I'd be interested to see what it returns for the scheduler. Since the schedule is running its searches under its own user context. Even if in your script example using environment variables, the environment variable would be based on the user who is running the script, it would not have information about other users on the system. Which is really the challenge . If only one user is logged in at a time, then you could look for all users who have active logins: | rest /services/authentication/httpauth-tokens splunk_server=local | fields userName After excluding all the system userNames, assuming the correlation search has access to the rest endpoint, and that only one user is logged in....this would give you the username of a user logged into Splunk at the time the correlation search ran.

ericl42 · ‎03-11-2019

What ended up being the issue was that even though I told the add-on builder to not use a proxy, it was still using one from Splunks server.conf and splunk-launch.conf. I added the IPs/hostnames to the no proxy rule thinking that would work, but unfortunately it still didn't. The final solution to my problem was adding the following lines in my Python code to 100% tell it not to use any proxy. import os os.environ['no_proxy'] = '*'

ericl42 · ‎03-06-2019

Putting an official answer on here for anyone else that is having issues with this. If I used dc on the signatures field and then modified the where clause to be total_signatures, it worked perfectly for me. I still have all of the variables that I need for adaptive response. index=security*sep sourcetype IN (symantec:ep:proactive:file, symantec:ep:risk:file) | stats count by dest, signature, file_name, file_path, file_hash | stats dc(signature) AS total_signatures, values(file_name) as process, values(file_path) AS full_path, values(file_hash) AS sha256 count by dest | where total_signatures > 1

ericl42 · ‎01-31-2019

I've done quite a bit of research on this top and I've found this post from a few years ago which references George Starcher's blog post about it. I've gotten quite a ways into it but I've ran into an issue using my new search macro in the "Incident Review - Main" search. Below are the steps I've completed so far. Created a VirusTotal Adaptive Response Action that auto queries the domain of the notable event. This is working very well and I can get the results if I click on my VT notable event. I created a vtpositives(1) macro that looks like this (I know it's not best practices for some of my search items, this is just a dev system) search index=_* OR index=* VirusTotal "queried url" $query$ source!=audittrail | table positives When I run the macro from a search and input the URL, it shows the number of positive hits that VirusTotal shows up, which is the field I want to show up in additional fields under the notable event. I modified the "Incident Review - Main" search to add vtpositives(1) right before the risk_correlation field that is currently last. I have tried both with the (1) and without it. I know that the "query" field populates correctly within the notable event and the VirusTotal results. Once I go to click on the notable events, the page is 100% blank. It does not like my macro at all and prevents any search results from coming up. So my real question is how do I get the positives field out of my search macro and into the notable event? For some reason my URLs are not working above so here they are. - https://answers.splunk.com/answers/481995/splunk-enterprise-security-how-to-add-fields-to-no.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev - http://www.georgestarcher.com/splunk-enterprise-security-enhancing-incident-review/

ericl42 · ‎01-07-2019

Thanks for the information. I'm going to see if I can slightly modify this and use my index search instead of the data model because in some scenarios I want to be a lot more granular on hosts in X location vs. Y where the data model gives me all of it.

whrg · ‎12-03-2018

If you have multivalue fields like src_nt_hosts then you could either use | mvexpand src_nt_hosts or | eval src_nt_hosts=mvindex(src_nt_hosts,1)

Posts	38
Solutions	3
Karma Given	5
Karma Received	3
Member Since	‎11-27-2018

Online Status	Offline
Date Last Visited	‎01-21-2021 12:30 PM

Heavy Forwarded Filtering Hosts

Ingesting Azure Logs (IaaS, PaaS, OS, app, etc.)

Monitor File Activity on SMB Share

Adaptive Response Not Pulling Variables

Adaptive Response & Notable Race Condition

Stdev against Null Time Bucket- How to create a ru...

Why are bucket times expanding?

Standard Deviation for Security Events

Adaptive Response Variables

Current User Variable within Adaptive Response

Re: Chart average event occurrence per hour of the...

Re: Notable Event Custom Fields

Re: Stdev against Null Time Bucket

Heavy Forwarded Filtering Hosts

Re: Monitor File Activity on SMB Share

Re: Ingesting Azure Logs (IaaS, PaaS, OS, app, etc...

Re: Adaptive Response Not Pulling Variables

Re: Adaptive Response & Notable Race Condition

Re: Why are bucket times expanding?

Re: Standard Deviation for Security Events

Re: Adaptive Response Variables

Re: Current User Variable within Adaptive Response

Re: How to make the code work in an Adaptive Respo...

Re: How do you do a stats count by a specific fiel...

Add Adaptive Response fields to Notable Event

Re: How do you create a correlation rule for intru...

Re: Multiple Account Lockout Correlation