About zyun

zyun · ‎09-17-2021

Found that using the orig_sid in the notable's event fields can provide the indirect link to the drilldown. Ex. localhost:8000/en-US/app/SplunkEnterpriseSecuritySuite/search?sid=<orig_sid>

zyun · ‎09-10-2021

Hello, I'm looking to reference a specific artifact from the Phantom Playbook Visual Editor. For example, a Phantom: Update Artifact block takes two parameters: artifact_id and cef_json. The list of default datapaths for artifact_id all follow the format of artifact:*.<field>, where the wildcard causes the update to occur on ALL artifacts. I would instead like to reference the first artifact in the container, so that only the first artifact is updated. Is there a way to construct the datapath to accomplish this? The current workaround I have for this is to use a Custom Function to output the first artifact object of the container, but this only creates a snapshot of the artifact object at the time the function is called; If I update the artifact after calling the function, I'll need to call the function again to get the updated artifact object values. The closest thing I've seen to this is the phantom.collect() API call, in which you can specify a datapath with a specific label (ie. phantom.collect(container, "artifact:uniqueLabel")), where you can specify a label and only the artifacts with the given label is returned, but this same syntax does not work in the Playbook Visual Editor.

zyun · ‎09-01-2021

I'm looking to update an artifact in a custom function. The closest thing that's supported is being able to update a container, or delete/add artifacts which is not what we want to do (as the initial artifact must stay intact). Is there any workaround for updating artifacts in a CF, or are there any plans to include update_artifact into the supported Custom Function API commands?

zyun · ‎08-30-2021

We're currently using Splunk ES, and would like to grab the link to a notable event's drilldown link on the ES Incident Review page without having to manually copy it. The closest solution that I've come across is automatically building the URL by using a `notable` search and piecing together the earliest/latest times and drilldown search, but I feel like there might be a more elegant solution out there.

zyun · ‎02-24-2020

Our deployment is currently looking to integrate the DB connect app to pull in data from the databases and to use in dashboards and so forth. However, we want the data to only be pulled from the database, with no writing or otherwise modifying the current data. Is there a way to disable the export functionality directly? Or would we just have to set the service account created for the identity to have minimum read-access? https://apps.splunk.com/apps/id/splunk_app_db_connect

zyun · ‎12-02-2019

I'm currently trying to understand how an app and add-on would interact if the app's version is out of date, but the add-on is not. Example: The Splunk App for Unix & Linux only supports Splunk Enterprise compatibility up to version 7.2. https://splunkbase.splunk.com/app/273/#/overview The Splunk Technology Add-on for Unix & Linux supports Splunk Enterprise compatibility up to version 8.0. https://splunkbase.splunk.com/app/833/#/overview The Nix Add-on description states that it works in tandem with the Nix App. If we were on Splunk Enterprise 7.3, where the Nix App is out of compatibility but the Nix Add-on is not, would the add-on continue to work as expected? Or do we have to stay on the minimum version, 7.2, for these components to work?

zyun · ‎05-09-2019

Could you expand on the different ways when you say 'avenue for access'?

zyun · ‎05-09-2019

I am co-managing a client's Splunk deployment, and it's come to my attention that several applications need updates (For example, the Enterprise Security app). Downloading the file requires a Splunk account with the proper license for the app. What would be the best way to go about getting access to download the latest versions on Splunkbase (with least privilege in mind)?

Posts	8
Solutions	1
Karma Given	4
Karma Received	1
Member Since	‎02-14-2019

Online Status	Offline
Date Last Visited	‎09-22-2021 01:35 PM

How to reference a specific artifact in Phantom Pl...

Phantom: How to update an artifact in a Custom Fun...

How to get a notable event's drilldown URL

[DB Connect] Prevent users from writing to databas...

Functionality of a Splunk app & add-on with differ...

How do I download update files on behalf of a clie...

Re: How to get a notable event's drilldown URL