Hi there, We now have a service that provides us with a threat intel list. However, if we need to access that URL, we need to parse an API key. Can someone suggest how I could get this sorted? Has someone previously done this? Thanks. ... View more

Hi all, Is there a way we can see all new/pending/closed investigations created? Mind you we can create investigations without having any notable events. I Know looking into Incident Audit - but i am not sure if you can only fetch those specific things i need. ... View more

Hi, i am trying to find failed and success from all users with single ip. so it would show like.. 1p 1.1.1.1...users john doe 4 failed and 1 success jay sean 5 failed 2 success ip1.2.3.4 ...user tim smith 3 failed 1 sucess starting query - index=authentication type=* |.... type is type of failure ... View more

HI All, Max Age for threat intel downloads. Does anyone know if each download gets stored in KV store for 30days or does it actually Override the last download and it resets. Cheers ... View more

HI all, Anyone out there had any benefit from the free Threat intel List in Splunk ES? Its causing alot of noise, I am not sure about the accuracy. Please shed some light someone? alexa_top_one_million_sites cisco_top_one_million_sites emerging_threats_compromised_ip_blocklist emerging_threats_ip_blocklist hailataxii_malware iblocklist_logmein iblocklist_piratebay iblocklist_proxy iblocklist_rapidshare iblocklist_spyware iblocklist_tor iblocklist_web_attacker icann_top_level_domain_list local_certificate_intel local_domain_intel local_email_intel local_file_intel local_http_intel local_ip_intel local_process_intel local_registry_intel local_service_intel local_user_intel malware_domains threatlist_domain maxmind_geoip_asn_ipv4 maxmind_geoip_asn_ipv6 mozilla_public_suffix_list phishtank sans zeus_bad_ip_blocklist zeus_standard_ip_blocklist ... View more

Hi There, I am trying to find where total account lockouts that are greater than 2 within the time frame of 30 mins. This is to find out potential malicious activity where someone is trying to possibility crack a password for an account. our lockout threshold is 15 mins and it gets unlocked. This way I can see if someone possibly has tried to log into an account more than 2 times and locked an account in 30 mins. Here is my query which gives me total results >2, but i am not sure how to specify the timeframe of 30 mins in the query. Any help would be appreciated. description="Account Lockouts" EventCode=4740 user="*" host=primarydc | stats count as total by user, host | where total > 2 ... View more

HI all, I have got a sufficient search to get license usage for the index that used by our Dev team. See below Search - index=_internal (idx=dev1 OR idx=dev2 OR idx=dev3) source=license_usage.log type="Usage" splunk_server= earliest=-1mon@mon@w | eval Date=strftime(_time, "%Y/%m/%d") | eventstats sum(b) as volume by idx, Date | eval MB=round(volume/1024/1024,2) | eval GB=round(volume/1024/1024/1024,2) | timechart first(GB) AS volume by idx However, I need it to be split by applications so 'data volume by index(dev1, dev2,dev3) by day by application name for the past month', but the applications field isnt available under_internal. I have found a search that has the information but not really sure how to merge it. index=dev1 OR index=dev2 OR index=dev3 Properties.ApplicationName="*" Any help would be greatful! Thanks ... View more

Hi All, Just curious to see what threat intel Enterprise Security Specialists/administrators are using for their SIEM. Out of the box you get plenty of options but most of them are false positives that cause a lot of noise. So i am keen to see what paid/free threat intel other security specialists are using out there or have had great experience with? some that give less false positives and are more accurate. I know this a very general question but certainly will help me step towards creating a good business case to on board paid intels. Thanks everyone. ... View more

I did a test port scan using nmap. This way I could catch what I was looking for in ES. Below is my query and it shows me exactly what i am looking for - shows me src_ip dest_ip count all the ports thats been hit and the user. index=ind_fw sourcetype="pan:traffic" type=TRAFFIC 172.xx.xx.xx 150.xx.xx.xx | stats count values(dest_port), values(user) by src_ip dest_ip However, I am stuck on the next phase. My next goal is to detect a similar result, where the user runs a scan it gets detected on my end. But i am unsure how i do this without defining the dest_ip and src_ip (like i have in the above query)? any help would be greatly appreciated. Thank you ... View more

This in regards to vulnerability center from Qualys issue - the datamodel gets updated every 24hrs (this cant change) and when we click in the vulnerability centre we get incorrect numbers. It seems like its counting the number of same vulnerability for the host multiple times which increases the number in the dashboard. I can search the index and get the correct result but the engineer wants to use the defined dashboard in ES. goal - to somehow dedup the count in that datamodel and get the correct asnwer using the datamodel datamodal query that gives incorrect info - | tstats summariesonly count from datamodel=Vulnerabilities.Vulnerabilities where earliest=-30d@d latest=+0s cim_filter_vuln_severity("Vulnerabilities") by Vulnerabilities.signature,Vulnerabilities.dest eg answer: count should be 1 instead of 8 Vulnerabilities.signature Vulnerabilities.dest count 'nlockmgr' Allows Proxying of NFS Requests 172.20.204.14 8 searching index that gives correct answer - eventtype="qualys_vm_detection_event" STATUS="NEW" OR STATUS="ACTIVE" earliest=-30d@d latest=+0s | dedup QID |stats count by dest_ip signature eg correct answer dest_ip signature count 172.20.204.18 'nlockmgr' Allows Proxying of NFS Requests 1 ... View more