About vietlq414

vietlq414 · ‎05-18-2023

Hi, I saw that you send 10 events to alert action but you just get one event in result. Is there any way that we can capture all 10 events?

vietlq414 · ‎12-25-2019

my file has more than 100000 line. i've try and add TRUNCATE properties but it did not work.

vietlq414 · ‎12-24-2019

I'm monitor a folder with some file. Could I make whole file as one event without line_breaker? I've tried transaction by source but it does not working as well as I want.

vietlq414 · ‎09-18-2019

does it's true if there are some success events between error events.

vietlq414 · ‎07-28-2019

It currently monitors filesystem changes and to make adjustments to that I modify an inputs.conf file under deployment_apps. I want to add windows registry monitoring. I don't understand what is registry path in search "*datamodel=Endpoint.Registry where Registry.registry_path="\\*" *". When I remote modify with REGEDIT and monitor with Sysmon, its does not return any path like that. Thanks,

Posts	5
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎04-17-2019

Online Status	Offline
Date Last Visited	‎11-09-2023 07:58 PM

Is it possible to ignore line breaker raw data?

Remote Registry Key modifications

Re: How to create a custom alert action Python scr...

Re: Is it possible to ignore line breaker raw data...

Is it possible to ignore line breaker raw data?

Re: Splunk alert to get consecutive errors from lo...

Remote Registry Key modifications