Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About wgawhh5hbnht
wgawhh5hbnht
Path Finder
Member since:
01-08-2019
3 weeks ago
Community Statistics
| Posts | 38 |
| Solutions | 2 |
| Karma Given | 55 |
| Karma Received | 0 |
| Member Since | 01-08-2019 |
Activity Feed
- Posted Windows Event Logs & Sysmon on Getting Data In. 3 weeks ago
- Karma Integration of Imperva Database Activity Monitor (DAM)? for Paolo_Prigione. 08-10-2020 09:28 AM
- Karma Re: Why Splunk CIM does not apply tags but 'Search & Reporting' does? for DEAD_BEEF. 06-30-2020 07:49 AM
- Karma Smartstore : Smartstore migration and it's impact to excess buckets? for rbal_splunk. 06-30-2020 06:42 AM
- Karma Tune out blocks for Threat Activity Detected in ES. for jbillings. 06-16-2020 02:03 PM
- Karma Refining Threat Activity Search for mtaylor78. 06-16-2020 02:02 PM
- Karma Re: generate a list of unique hashes and append new hashes hourly for richgalloway. 06-05-2020 12:51 AM
- Karma Re: Eval expression field not working in data model. for richgalloway. 06-05-2020 12:51 AM
- Karma ThreatHunting app (by Olaf Hartong) Red Triangle Error: "Could not load lookup=LOOKUP-eventcode" for aaronc9000. 06-05-2020 12:51 AM
- Karma Re: LINE_BREAKER & EXTRACT not working for maciep. 06-05-2020 12:51 AM
- Karma What's the best approach for migrating Splunk on premise to AWS cloud? for Vijeta. 06-05-2020 12:50 AM
- Karma Splunk Add-on for Amazon Web Services: Cannot index AWS config change notifications for D2SI. 06-05-2020 12:50 AM
- Karma I have enabled smart store for my standalone indexer. When I am trying to encrypt s3 using "sse-c" , I am getting below error- for rajuljain2605. 06-05-2020 12:50 AM
- Karma tstats web datamodel unable to use status in eval for eco_rb023. 06-05-2020 12:50 AM
- Karma Re: Combine multiple events into a new field for woodcock. 06-05-2020 12:50 AM
- Karma lookup error in splunk threathunting app for sabaKhadivi. 06-05-2020 12:50 AM
- Karma Help configuring Inputs.conf to take non-default Windows Event Log from multiple domain controllers for sgutierrez. 06-05-2020 12:50 AM
- Karma SSL Certificate Verify Failed for santorof. 06-05-2020 12:50 AM
- Karma What provides data to inputlookup:system_version_tracker for mmqt. 06-05-2020 12:50 AM
- Karma Error/warning message after upgrade from v7.2.1 to v.8.0.0 for tlabue. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
3 weeks ago
What's everyone doing for collecting both Windows Event Logs & Sysmon? Are you collecting all Even IDs or only a small subset? What Sysmon config are you using? Have you tuned it to your environment or just using something like SwiftOnSecurity's Sysmon config? I ask because our Windows license has grown from ~120G to ~250G and I need to reduce our license but don't want to miss anything.
... View more
Labels
- Labels:
-
Windows
06-04-2020
06:22 AM
And this will only include unique hashes? I'm concerned about the size of the lookup file growing too large.
As for the scheduled portion, would it make more sense to only use the existing search or should I include the lookup file in the search as well?
... View more
06-04-2020
05:00 AM
I would like to take the following search that generates the hashes and outputs the lookup:
index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" Image=* | fields Hashes | eval hash=split(Hashes,",") | mvexpand hash | dedup hash | rex field=hash "(?<type>[^=]+)" | rex field=hash "=(?<hash>[^=]+)" | table hash | outputlookup append=true hashes.csv
The output of the hashes.csv looks like this:
hash
29B7D02A3B5F670B5AF2DAF008810863
96BEC668680152DF51EC1DE1D5362C64C2ABA1EDA86F9121F517646F5DEC2B72
D7AB69FAD18D4A643D84A271DFC0DBDF
FF79D3C4A0B7EB191783C323AB8363EBD1FD10BE58D8BCC96B07067743CA81D5
601BDDF7691C5AF626A5719F1D7E35F1
4ED2A27860FA154415F65452FF1F94BD6AF762982E2F3470030C504DC3C8A354
9D59442313565C2E0860B88BF32B2277
How do I now take the hashes.csv and constantly add new unique hashes to it?
... View more
05-11-2020
06:12 AM
is splunk listening on the port? use
netstat -an | grep [whatever port you
specified]
In zoom you can check the call logs:
https://marketplace.zoom.us/user/logs
... View more
05-07-2020
02:18 PM
We have a SHC of three members & 1 Enterprise Security. Prior to 8.0 each were running their own datamodels. Now that shared datamodel summaries is possible, I would like to set this up to reduce performance and disk usage but have questions about the exact implementation as the documentation is vague: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Sharedatamodelsummaries
I know that in datamodels.conf I need to set acceleration.source_guid but that's it. My questions are:
Do I set this on the ES?
Do I use /opt/splunk/etc/system/local/datamodels.conf?
What would be the best way to verify the datamodels have been consolidated down to 1 copy? (right now datamodels are an exact copy of eachother)
... View more
Labels
- Labels:
-
using Enterprise Security
04-23-2020
01:51 PM
It did create the "Success" & "Failure".
If I run your new query, this is the results:
Values Count %
unknown - Decrypt 118137 79.418
unknown - Encrypt 28543 19.188
unknown - VPN Routing 1859 1.250
unknown - Key Install 80 0.054
unknown - Reject 74 0.050
unknown - Drop 31 0.021
Success 24 0.016
unknown - Log Out 6 0.004
(I searched separately and there weren't any failed log ins during this time period)
... View more
04-23-2020
12:29 PM
while this did get me closer, in that it provided both the Success & Failure, it unfortunately gave all the other actions too, which is exactly what I'm attempting to avoid.
Values Count %
Decrypt 143864 82.951
Encrypt 27243 15.708
VPN Routing 2082 1.200
Key Install 186 0.107
Drop 23 0.013
Reject 18 0.010
Success 12 0.007
Log Out 3 0.002
Allow 1 0.001
Any idea why putting essentially a true clause at the end makes the Success & Failure case work? Any way to get this to work without obtaining all the other action results?
... View more
04-23-2020
11:39 AM
It's because you removed the ".". If you wanted not rename the field you would need to add quotes around it, e.g. "wells.resp_code"="...
... View more
04-23-2020
11:35 AM
an error message:
Error in 'eval' command: The arguments to the 'case' function are invalid.
... View more
04-23-2020
10:47 AM
Here is my attempt to create a new field eval in datamodels (no results):
Here is the same data, just not using the datamodel:
... View more
01-17-2020
08:39 AM
"#" on [veracode] didn't get copied over in props.conf, updated my post.
But to answer your question, I commented out lines 2 & 14 (& uncommented out line 1), same outcome, even with |extract reload=T in the search
... View more
01-16-2020
01:35 PM
I'm attempting to ingest Veracode data into Splunk, there isn't anything on splunkbase and based on Veracode's forums, the best way is to make API queries and output as a .csv file. The API calls come from a UF and send directly to our index cluster.
inputs.conf:
#veracode
[monitor:///opt/splunk/logs/veracode/.../*.csv]
index = veracode
sourcetype = veracode
crcSalt = <SOURCE>
The props (below) was created by Splunk using the "Add Data" & uploading a sample of the data in a file. When I do it this way, Splunk auto-parsed everything, without any combining of events and no need to create a EXTRACT-, with the following props (which I put on the indexers).
props.conf:
#[veracode]
[source::/opt/splunk/logs/veracode/.../*.csv]
DATETIME_CONFIG=CURRENT
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
KV_MODE=none
category=Structured
description=Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled=false
pulldown_type=true
EXTRACT-veracode=^"(?<app_id>[^"]*)","(?<app_name>[^"]*)","(?<app_business_unit>[^"]*)","(?<build_id>[^"]*)","(?<build_name>[^"]*)","(?<build_type>[^"]*)","(?<build_policy_updated_date>[^"]*)","(?<build_published_date>[^"]*)","(?<build_analysis_size_bytes>[^"]*)","(?<flaw_id>[^"]*)","(?<flaw_date_first_occurrence>[^"]*)","(?<flaw_severity>[^"]*)","(?<flaw_cweid>[^"]*)","(?<flaw_categoryname>[^"]*)","(?<flaw_affects_policy_compliance>[^"]*)","(?<flaw_remediationeffort>[^"]*)","(?<flaw_remediation_status>[^"]*)","(?<flaw_mitigation_status_desc>[^"]*)","(?<flaw_exploitLevel>[^"]*)","(?<flaw_module>[^"]*)","(?<flaw_sourcefile>[^"]*)","(?<flaw_line>[^"]*)"
Sample data:
"app_id","app_name","app_business_unit","build_id","build_name","build_type","build_policy_updated_date","build_published_date","build_analysis_size_bytes","flaw_id","flaw_date_first_occurrence","flaw_severity","flaw_cweid","flaw_categoryname","flaw_affects_policy_compliance","flaw_remediationeffort","flaw_remediation_status","flaw_mitigation_status_desc","flaw_exploitLevel","flaw_module","flaw_sourcefile","flaw_line"
"527625","Vault Microservice","Corp Development","4130495","10.4.104 Promoted","static","2019-05-16 22:05:39+00:00","2019-05-16 22:02:38+00:00","1125889","219","2019-04-10 23:22:12+00:00","3","259","Use of Hard-coded Password","false","4","New","Not Mitigated","1","Vault.MessageHandlerService.exe","connectionconfiguration.cs","1"
"527625","Vault Microservice","Corp Development","4130495","10.4.104 Promoted","static","2019-05-16 22:05:39+00:00","2019-05-16 22:02:38+00:00","1125889","220","2019-04-10 23:22:12+00:00","3","73","External Control of File Name or Path","false","2","New","Not Mitigated","0","Vault.MessageHandlerService.exe","exhibittrackervaultrepository.cs","518"
"527625","Vault Microservice","Corp Development","4130495","10.4.104 Promoted","static","2019-05-16 22:05:39+00:00","2019-05-16 22:02:38+00:00","1125889","222","2019-04-10 23:22:12+00:00","3","331","Insufficient Entropy","false","2","New","Not Mitigated","-1","Vault.Web.exe","auditwritelogger.cs","43"
"527625","Vault Microservice","Corp Development","4130495","10.4.104 Promoted","static","2019-05-16 22:05:39+00:00","2019-05-16 22:02:38+00:00","1125889","223","2019-04-10 23:22:12+00:00","3","73","External Control of File Name or Path","false","2","New","Not Mitigated","0","Vault.MessageHandlerService.exe","exhibittrackervaultrepository.cs","532"
"527625","Vault Microservice","Corp Development","4130495","10.4.104 Promoted","static","2019-05-16 22:05:39+00:00","2019-05-16 22:02:38+00:00","1125889","224","2019-04-10 23:22:12+00:00","3","73","External Control of File Name or Path","false","2","New","Not Mitigated","0","Vault.MessageHandlerService.exe","chunkconcierge.cs","67"
"527625","Vault Microservice","Corp Development","4130495","10.4.104 Promoted","static","2019-05-16 22:05:39+00:00","2019-05-16 22:02:38+00:00","1125889","225","2019-04-10 23:22:12+00:00","2","404","Improper Resource Shutdown or Release","false","2","New","Not Mitigated","0","Vault.MessageHandlerService.exe","vaultfilechunkstream.cs","8"
"527625","Vault Microservice","Corp Development","4130495","10.4.104 Promoted","static","2019-05-16 22:05:39+00:00","2019-05-16 22:02:38+00:00","1125889","227","2019-04-10 23:22:12+00:00","3","352","Cross-Site Request Forgery (CSRF)","false","4","New","Not Mitigated","0","Vault.Web.exe","itemscontroller.cs","24"
"527625","Vault Microservice","Corp Development","4130495","10.4.104 Promoted","static","2019-05-16 22:05:39+00:00","2019-05-16 22:02:38+00:00","1125889","228","2019-04-10 23:22:12+00:00","2","100","Technology-Specific Input Validation Problems","false","3","New","Not Mitigated","0","Vault.Web.exe","patchmetadatamodel.cs","8"
"527625","Vault Microservice","Corp Development","4130495","10.4.104 Promoted","static","2019-05-16 22:05:39+00:00","2019-05-16 22:02:38+00:00","1125889","229","2019-04-10 23:22:12+00:00","3","352","Cross-Site Request Forgery (CSRF)","false","4","New","Not Mitigated","0","Vault.Web.exe","aycoadvisorvaultuploadcontroller.cs","77"
Some of the files only contain the header, annoying but I whatever. The biggest problem is:
1 combining of events.
2 fields not working via EXTRACT.
... View more
11-27-2019
07:14 AM
If you did upgrade to Splunk 8.0 & didn't run the Readiness App and the WebUI isn't running, try this:
Check the /opt/splunk/var/log/splunk/web_service.log
You're looking for something like this:
2019-11-26 23:29:03,566 ERROR [5dddb53f357fd0e7c7cf90] root:769 - Unable to start splunkweb
2019-11-26 23:29:03,566 ERROR [5dddb53f357fd0e7c7cf90] root:770 - 'dict' object has no attribute 'iteritems'
Traceback (most recent call last):
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py", line 132, in <module>
from splunk.appserver.mrsparkle.controllers.top import TopController
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/top.py", line 27, in <module>
from splunk.appserver.mrsparkle.controllers.admin import AdminController
File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 17, in <module>
import formencode
File "/opt/splunk/lib/python3.7/site-packages/formencode/__init__.py", line 9, in <module>
from formencode import validators
File "/opt/splunk/lib/python3.7/site-packages/formencode/validators.py", line 15, in <module>
import dns.resolver
File "/opt/splunk/etc/apps/generateblocklist_app/bin/dns/resolver.py", line 32, in <module>
import dns.flags
File "/opt/splunk/etc/apps/generateblocklist_app/bin/dns/flags.py", line 51, in <module>
_by_value = dict([(y, x) for x, y in _by_text.iteritems()])
AttributeError: 'dict' object has no attribute 'iteritems'
Where there is an attribute error.
Move the offending app to disabled and attempt to restart splunk again. You may have to do this several times depending on if there are multiple offending apps or not.
Deleting generateblocklist app solved the splunk webui not starting for me.
... View more
09-27-2019
06:58 AM
I opened a case with Splunk support & they said this an expected behavior, it either needs more work or there is something specific that's causing hundreds of these alerts per day. To reduce the noise I've eliminated all Domain Controller IPs & Hostnames. Next I added multiple looks for the IPs, this is done based on both src & previous_src:
| lookup dnslookup clientip as src OUTPUT clienthost as src_fqdn
| lookup dnslookup clientip as previous_src OUTPUT clienthost as previous_src_fqdn
I then remove any matches between srcfqdn & previoussrc_fqdn:
| where (src_fqdn!=previous_src_fqdn)
I needed to remove the Fully Qualified Domain Name (FQDN) to match possible src/previous_src:
| rex field=src_fqdn "(?<src_host>^([^.]+))"
| rex field=previous_src_fqdn "(?<previous_src_host>^([^.]+))"
Then I added multiple where clauses to eliminate duplicates:
| where (src_host!=src) AND (src_host!=previous_src) AND (previous_src_host!=src) AND (previous_src_host!=previous_src)
While all of this has reduced the noise from thousands of alerts per day to hundreds, it unfortunately has added a lot of overhead. If anyone has any suggestions to speed this up, I would appreciate any assistance.
... View more
09-26-2019
10:35 AM
Moved the props.conf from UF to indexer...duh
then made the following changes to props.conf:
[Script:dhcp_lease]
SHOULD_LINEMERGE = true
DATETIME_CONFIG = CURRENT
TRUNCATE = 999999
BREAK_ONLY_BEFORE = MIBCounts
all lines are now showing and in 1 event.
... View more
09-17-2019
02:52 PM
We're getting false positives on the correlated search, "Concurrent Login Attempts Detected", because the previous_src and the src are the hostname and IP of the same system.
In ES if I use Investigate Asset Artifacts and enter the hostname, the IP is returned, and vice versa. To me that means the asset lookups are functioning properly, right?
Anyone know how to correct for this?
... View more
09-11-2019
01:23 PM
I've also attempted to output the results of the .bat to a file & the file also gets cut off after the first 9 lines.
... View more
09-09-2019
03:49 PM
Same outcome.
I've verified the splunk agent is restarting on the DCHP servers after each deployment push. Any other thoughts?
... View more
09-09-2019
03:05 PM
Sorry, I should have also posted my props.conf.
Please let me know something isn't right, I've changed this many times and still I'm unable to get it to work:
[Script:dhcp_lease]
SHOULD_LINEMERGE = false
DATETIME_CONFIG = CURRENT
LINE_BREAKER = ([\r\n]+)
TRUNCATE = 0
... View more
09-06-2019
12:19 PM
Have you tried enabling useACK=true
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
Karma given to
