About dbroggy

dbroggy · ‎08-20-2024

Hi there! I'm looking for a comprehensive list of report ideas for all of security, including management/metrics, operations, and compliance. Has anyone created such a list? Would you mind sharing? I'd like to see a long list or reports so I can help identify gaps in security posture. Thanks!!!

dbroggy · ‎01-25-2023

Doesn't seem to work anymore. might need a flag option for ssl_verify=false (or something more secure 🙂 ) AttributeError at "/opt/splunk/etc/apps/TA-VirusTotal/bin/virustotal.py", line 508 : 'SSLError' object has no attribute 'message'

dbroggy · ‎04-24-2022

Hi there, Is it possible to search for windows interactive logons from the Authentication data model? eg. I can do it this way: index=* source="*WinEventLog:Security" LogonType=2 OR LogonType=10 OR LogonType=11 And I'm looking for an equivalent way using a data model eg: | tstats summariesonly=true count from datamodel=Authentication by Authentication.action Authentication.app Authentication.dest Authentication.signature Authentication.src Authentication.src_user Authentication.user |search <SOME LOGIC> Thank you!

dbroggy · ‎04-22-2022

I'm not seeing this Security_ID field for the transaction in my windows logs, I understand the rest of your logic perfectly.

dbroggy · ‎03-31-2022

old topic, but SSE has changed a lot since 2020. Simple answer: SSE: Setup > Content Introspection - will auto scan your existing log sources and then provide recommendations for your security use cases. BE PATIENT! Introspection queries ALL of your data so best to use this button on a new system vs one with tons of data. I don't know a way to limit the scanning range. Plan B: Setup > Data Inventory - manually map your log sources to the long list of data source types.

dbroggy · ‎03-24-2022

I would really love to use Campus Compliance Toolkit for NIST 800-171 But I have Splunk Cloud Enterprise. Splunkbase says version 1.0.2 works, but sadly Splunk support says it doesn't. Is there any chance others like this tool and have made it work? Or is there an alternative NIST reporting app out there (that doesn't require an annual license fee)? Thank you for your feedback.

dbroggy · ‎03-17-2022

that presentation seems to just say 'get enterprise security'.

dbroggy · ‎03-12-2022

I love the simplicity of SMFS Why was it discontinued? Security Essentials isn't really suited for the same purpose.

dbroggy · ‎03-21-2021

Hi Everyone, I'm looking for some Splunk Enterprise Security tips, maybe in the form of a cheatsheeet. Specific topics of interest: 1. Recommended 'base apps' for ES, eg: CIM ESCU CIM-Validator lookup file editor knowledge object explorer more?? 2. Some sort of validator for apps/addons for all required sourcetypes, and info on which peer to install them on. eg. For Azure: SH - App and addon, HF - App and addon 3. And finally ways to quickly validate logs eg: use CIM Validator, pick a log source and match it to a datamodel - verify the required fields exist. if it fails, and the sourcetype is supposed to be CIM compliant, verify you've installed the appropriate app/addon on the SH and/or HF. or use queries like this to validate your logs, based on a table that matches the required fields: |datamodel Intrusion_Detection IDS_Attacks search|dedup sourcetype|rename IDS_Attacks.* as *|table sourcetype action category dest signature src user vendor_product I would greatly appreciate your feedback and better ways to validate your ES installation. Thanks.

dbroggy · ‎01-23-2021

none of the above queries seem to work.

dbroggy · ‎01-23-2021

Not close to a perfect solution but it works for me: Run this query to get the rules and SPL: | rest splunk_server=local count=0 /services/saved/searches |table title, search Filter down just the titles with the word 'Rule' at the end of the title. Ok so now you have the rule names and the spl for each. Then I do some messy sed/awk/grep to extract the data models associated with each - this is optional. Then I read each rule and it's usually not difficult to guess which logs sources would probably work with those rules - eg: if the rules starts with 'Access', I put os/auth/AD Endpoint - endpoint (easy) etc. etc. There's ONLY about 350 rules so take some time and you'll at least have a decent short list to focus on.

dbroggy · ‎02-13-2020

Or if you don't care to see all of those fields: | rest splunk_server=local /services/search/distributed/peers/ |table splunk_server server_roles version However this query may not list roles for any of: cluster master license server deployment server monitoring console

dbroggy · ‎01-27-2020

try saving as a report, enabling report acceleration, and then apply the report to your dashboard.

dbroggy · ‎01-24-2020

you mean this? https://splunkbase.splunk.com/app/4336/#/details

dbroggy · ‎09-10-2019

Thanks for trying, but it's not that cut and dry. There are several links leading off of the link you mentioned which point to both github and splunkbase, and some refer to BOTS 1.0 and some refer to 2.0.

dbroggy · ‎09-10-2019

Right, but on that link you mentioned it says this: BOTS 2.0 Questions and Answers We're happy to send you a copy of the BOTS 2.0 questions and answers upon request! All you have to do is register here. That link in 'here' uses this link: https://events.splunk.com/BOTS_2_0_datasets And once you fill out that form you're supposed to get access to the questions like these:

dbroggy · ‎09-10-2019

There seem to be 3 apps for the scorecard: SA-ctf_scoreboard SA-ctf_scoreboard-master SA-ctf_scoreboard_admin But scoreboard and scoreboard-master have the same app title, so if you install both of them you end up with 2 'Capture the Flag' apps listed in Splunk. is SA-ctf_scoreboard obsolete?

dbroggy · ‎09-10-2019

There's supposed to be a list of questions that can be used with the BOTS data set. From what I've read you have to fill out the form in a link. I filled out the link form, but there's no clarity on how I get the questions after that's done.

dbroggy · ‎07-02-2019

here's the command line way: splunk enable web-ssl splunk set web-port 443 splunk restart (assuming you're using the built in ssl keys)

dbroggy · ‎07-01-2019

I'm not sure what your alert is looking at but normally the trigger time would be the same time as the last event associated with your alert. I appreciate whatever is actually set as the trigger time information might not be stored in your event but generated via backend python. eg. https://answers.splunk.com/answers/293978/how-to-change-the-alert-email-trigger-time-format.html

dbroggy · ‎07-01-2019

Why don't you just add an eval function to your alert query and calculate the time difference into a new key or overwrite the trigger time key?

dbroggy · ‎07-01-2019

Unless you're using a sniffer to collect your logs (most people aren't) the logs won't be encrypted between your dns server and splunk. If they are, there should be a supported mechanism like HEC or secure syslog.

dbroggy · ‎07-01-2019

more current answer is here: https://answers.splunk.com/answers/607068/the-maximum-number-of-concurrent-historical-search.html I beleive it simply comes down to how many searches you're running vs how many cpu's you have. If you bother to change limits.conf just to remove the message it won't change the fact that you're limited by the number of cpus.

dbroggy · ‎06-23-2019

But I'm pretty sure that's the wrong syntax. "-mode slave" assigns an indexer to the indexer cluster. And search heads don't do replication to an index cluster so replication_port makes no sense. The command should be: ./splunk edit cluster-config -mode searchhead -site site0 -master_uri https://:8089 -secret pass123 Ref: https://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/SHCandindexercluster

dbroggy · ‎06-23-2019

I don't understand why Thomas is using the cluster-config command to add a search head. should be the shcluster-config command.

Posts	34
Solutions	0
Karma Given	11
Karma Received	4
Member Since	‎02-10-2019

Online Status	Offline
Date Last Visited	‎08-20-2024 02:47 PM

Full list of security reports - compliance and ope...

How to search windows interactive logon from the A...

Campus Compliance Toolkit for NIST 800-171

What happened to SM4S?

Splunk Enterprise Security Cheat Sheet

Which apps are used for the scorecard?

BOTS: Where is the questions listing?

Full list of security reports - compliance and ope...

Re: VirusTotal app on Splunk giving search error

How to search windows interactive logon from the A...

Re: Example of how to detect new local admin accou...

Re: How to get data into Splunk Security Essential...

Campus Compliance Toolkit for NIST 800-171

Re: Anyone know where I can find 800-53 Controls S...

What happened to SM4S?

Splunk Enterprise Security Cheat Sheet

Re: Listing all tags in the search interface

Re: What data sources does Splunk for Enterprise S...

Re: Find out the role of a Splunk server

Re: Why is my search slow when performed in a dash...

Re: Is it possible to import AlienVault OTX data t...

Re: Which apps are used for the scorecard?

Re: Which apps are used for the scorecard?

Which apps are used for the scorecard?

BOTS: Where is the questions listing?

Re: how to enable https

Re: How do I change my Alert TZ?

Re: How do I change my Alert TZ?

Re: streams and DNS over (HTTPS or TLS)...DoH/DoT

Re: The system is approaching the maximum number o...

Re: Why am I unable to set up a search head cluste...

Re: Why am I unable to set up a search head cluste...