Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sheamus69
sheamus69
Communicator
Member since:
05-21-2014
10-12-2021
Community Statistics
| Posts | 71 |
| Solutions | 6 |
| Karma Given | 51 |
| Karma Received | 21 |
| Member Since | 05-21-2014 |
Activity Feed
- Karma Re: Field extraction for multiple types of values for gcusello. 03-01-2021 02:13 AM
- Posted Re: Email automation issue on Splunk Enterprise. 03-01-2021 02:08 AM
- Got Karma for Re: Functionality of keepevicted not clear. 01-13-2021 11:10 PM
- Posted Re: Functionality of keepevicted not clear on Splunk Search. 01-13-2021 06:38 AM
- Posted Email automation issue on Splunk Enterprise. 11-09-2020 07:34 AM
- Posted Re: Workflows dependent on the content of a field on Splunk Enterprise Security. 11-09-2020 07:14 AM
- Posted Workflows dependent on the content of a field on Splunk Enterprise Security. 09-22-2020 03:37 AM
- Karma Re: How to create a regex expression to mask the input? for manjunathmeti. 06-05-2020 12:51 AM
- Karma Re: how can I get Hostnames anits respective IP address through a query.For e.g (index=winlog | Stats count by host) only returns hostnames .I would like the hostname and IP address for wmyersas. 06-05-2020 12:50 AM
- Karma Re: Index main for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Splunk buildin intelligence feed for lakshman239. 06-05-2020 12:50 AM
- Karma Re: Detecting different character sets in an email subject for dkeck. 06-05-2020 12:50 AM
- Karma Re: Extracting words in a string with regular expressions for jpolvino. 06-05-2020 12:50 AM
- Karma Re: How to re-run a scheduled correlation search after planned downtime? for kamal_jagga. 06-05-2020 12:49 AM
- Karma Re: How to search to find a match in lookup file? for elliotproebstel. 06-05-2020 12:49 AM
- Karma Re: Regular expression is not working properly.. Please suggest for 493669. 06-05-2020 12:49 AM
- Karma Re: show percentage as a new field for harsmarvania57. 06-05-2020 12:49 AM
- Karma Re: Macro : modular_action_invocations(Apps: Splunk_SA_CIM) for gabriel_vasseur. 06-05-2020 12:49 AM
- Karma Re: How do I extract a field from the _raw data for richgalloway. 06-05-2020 12:49 AM
- Got Karma for Re: How to search to find a match in lookup file?. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
03-01-2021
02:08 AM
OK, I managed to get this working through using Alerts instead of Correlation searches. I have no idea why using a Correlation wouldn't work, presumably they work subtly different to alerts under the hood? So, in short, to get this working I saved my main search as an alert, with a scheduled run time. Within the scheduled search settings there was an option to Trigger for each event - selecting this fixed my issue. Sheamus
... View more
01-13-2021
06:38 AM
1 Karma
Hi, If my memory serves me correctly, transactions can only look at a finite number of events - if that number is breached then the transaction is cancelled. Splunk docs for transactions show: maxevents
Syntax: maxevents=<int>
Description: The maximum number of events in a transaction. If the value is negative this constraint is disabled.
Default: 1000 Thus, when you add *ABC* to the start of the search, you are reducing the number of events that the transaction is searching through, compared to when you do not include *ABC*?
... View more
11-09-2020
07:34 AM
Hi, I have put together a correlation which looks as user account lockouts, and have had it to send an email (using the GUI Adaptive Response Actions). My issue is that if the correlation detects a single lockout within it's search window, it will generate the email, however, if there are multiple results returned, it fails to send out emails. Example correlation search: | tstats summariesonly=true count earliest(_time) as FirstSeen latest(_time) as LastSeen values(All_Changes.src) as Computer values(All_Changes.Account_Management.dest_nt_domain) as All_Changes.Account_Management.dest_nt_domain
from datamodel=Change
where All_Changes.result_id=4740 All_Changes.Account_Management.src_nt_domain=mydomain
by All_Changes.Account_Management.src_nt_domain All_Changes.user All_Changes.result_id All_Changes.result All_Changes.signature
| eval FirstSeen=strftime(FirstSeen,"%Y-%m-%d %H:%M.%S"), LastSeen=strftime(LastSeen,"%Y-%m-%d %H:%M.%S")
| rename All_Changes.* as *
| rename Account_Management.* as *
| `thales_get_asset(dest_nt_domain)`
| `get_identity4events(user)`
| table FirstSeen LastSeen src_nt_domain dest_nt_domain user_original user_first user_email Computer result_id result signature count Computer_description Computer_ip Computer_lookup_source Computer_owner With the Email Adaptive response configured something like so: To: $result.user_email$
Subject: $name$ - $result.user_original$
Body:
Hi $result.user_first$,
[some explanation stuff here]
Between $result.FirstSeen$ and $result.LastSeen$, your account $result.user_original$ has been locked out $result.count$ times.
These account lockouts occurred on the following systems:
$result.dest_nt_domain$
[blah blah etc] Any idea what I am doing wrong here, any advice on how to progress, etc? Cheers, Sheamus
... View more
Labels
- Labels:
-
development
11-09-2020
07:14 AM
No. I have a correlation that flags a risk object that breeches a risk threashold. The notable generated lists the individual correlations that have generated these risks. What I am trying to do is have workflows available to assist with investigating these risks, but I only want them to be offered when a relevant risk is listed. For example, if the risks generated included multiple failed logins and a malware alert, I would want a workflow to take me to a dashboard to investigate the failed logins and a separate workflow to look at the malware alert. I want the workflows offered to reflect the risks generated for that notable. Hope that makes more sense?
... View more
09-22-2020
03:37 AM
I am working on improving usage of the risk framework within our instance of Splunk ES. At present there are a number of correlations that only generate risk scores, and we have alerting on risk objects with high risk scores. While this approach reduces noise in IR, it does make it less intuitive to investigate the reasons a risk object scores so high. I would like to find a way to picks up on what risks events were triggered for an object, and offer me appropriate workflows. So if an alert triggered for high risk objects, with the following risks events: Malware detected Suspicious Web Activity Individual Workflows would be offered to help investigate each of these risks. Has anyone else done something like this before? Is it even possible?
... View more
Labels
04-09-2020
09:35 AM
The AccountExpires field in an AD log is described as:
The date when the account expires. This value represents the number of 100-nanosecond intervals since January 1, 1601 (UTC). A value of 0 or 0x7FFFFFFFFFFFFFFF (9223372036854775807) indicates that the account never expires.
https://docs.microsoft.com/en-us/windows/win32/adschema/a-accountexpires
The long string doesn't follow the standard unix epoch time, so the strftime function doesn't seem to apply.
Does anyone know the formula for resolving this?
Sample data Set:
accountExpires, accountExpires_strftime, ActualExpiry
132066576000000000, 11:59.59 pm, Fri 12/31/9999, 03/07/2019 21:00
0, 01:00.00 am, Thu 01/01/1970, Never
131775408000000000, 11:59.59 pm, Fri 12/31/9999, 31/07/2018 21:00
131748624000000000, 11:59.59 pm, Fri 12/31/9999, 30/06/2018 21:00
131693328000000000, 11:59.59 pm, Fri 12/31/9999, 27/04/2018 21:00
Thanks in advance,
Sheamus
... View more
03-09-2020
04:20 AM
I didn't get all that far, myself. I found the vmware logging documentation to be absolutely useless, and most of what came in the logs was just noise.
If you progress this further, I'd be interested in what you have achieved.
... View more
02-03-2020
09:51 AM
You might find these useful:
https://answers.splunk.com/answers/188709/how-to-display-dashboard-panels-dynamically.html
https://answers.splunk.com/answers/734519/how-to-hide-panels-based-on-other-panels-result.html
You can set conditions to hide and unhide panels as needed.
... View more
01-08-2020
08:10 AM
Looks like a typo there:
index="uam" User="abcd"
| eval access_time=strftime(_time, "%Y-%d-%m %H:%M:%S")
| rename access_time as TIME
| stats count by USER TIME
| fields - count
Should sort it
... View more
08-20-2019
09:20 AM
Have you tried something like:
index=msexchange recipient_status="451 4.3.2 *" | stats dc(host) as host_count by host | where host_count > 1
You could also do some sort of combo like:
index=msexchange recipient_status="451 4.3.2 *" | stats count dc(host) as host_count by host | where ( host_count > 1 AND count > 100 )
... View more
08-20-2019
09:15 AM
Have you tried something like:
index=msexchange recipient_status="451 4.3.2 *" | stats dc(host) as host_count by host | where host_count > 1
You could also do some sort of combo like:
index=msexchange recipient_status="451 4.3.2 *" | stats count dc(host) as host_count by host | where ( host_count > 1 AND count > 100 )
Note: edited to fix a bug
... View more
08-20-2019
09:12 AM
That doc just tells you the name of log files, it doesn't give any explanation of what to expect in the logs.
... View more
08-20-2019
08:28 AM
Has anyone had experience of ingesting logs from VMWare Unified Access Gateway (UAG)?
Splunkbase doesn't seem to have any apps for UAG, and looking at the VMWare docs for help interpreting the logs hasn't been much use.
Any Help / Advice would be gratefully received.
... View more
Labels
- Labels:
-
other
08-09-2019
04:00 AM
What specifically are you trying to do with the lookup? Can you give an example?
... View more
08-09-2019
02:40 AM
If all you want to do is read the contents of the lookup try the inputlookup command.
For example,
|inputlookup file.csv
will list the entire contents of the lookup. You can search for a specific entry in the lookup using:
|inputlookup file.csv | search fieldname=whatever
To perform a lookup against the csv during a search would use the lookup command, like:
[main search] | lookup file.csv fieldname OUTPUT otherfieldnames|...
To write to a lookup you would use outputlookup.
For example:
|inputlookup file.csv|eval cn=if(cn=="something","something else",cn)|outputlookup file.csv
Will perform the lookup, and will change an entry in the field cn if it contains a specific value, and will then overwrite the original lookup (it is always advisable to test the results before performing this overwrite as errors can be embarrassing to fix).
Hope this helps,
Sheamus
... View more
03-29-2019
06:54 AM
What specific TA are you referring to?
... View more
01-31-2019
09:12 AM
That was an interesting approach I hadn't considered. The problem I am finding is that there seem to be lots of edge cases, such as é, í, !, ", £, $, %, ... I keep going back and finding more to exclude.
Not sure if this is the best way to do it, or if theres an alternate approach?
... View more
01-31-2019
07:32 AM
I want to report on emails containing subjects that are using difference character sets, such as Chinese, Russian, Greek alphabet, etc.
Is there an easy way to pull out the character encoding from the emails?
eg:
Sender: someone@somewhere.com
Sender: 你好，世界
... View more
- Tags:
- splunk-enterprise
10-31-2018
03:56 AM
Have you got a sample log entry you can share? Feel free to sanitise as needed.
... View more
09-17-2018
07:28 AM
If left to Splunk defaults, the severities should be calculated based on the severity assigned to the notable event, cross referenced with the priorities of affected assets and users.
However, you can manually set a severity value by using a field called "severity", which Splunk will use as the severity value. This can be useful for when you want to dynamically change the severity based on other factors, such as a CVE score on an IDS detection.
e.g.
...|eval severity=case(cvs_score>9, "critical", cvs_score>7, "high", cvs_score>4, "medium", cvs_score>0, "low", 1==1, "unknown")
It is also worth noting that some IDS/IPS/AV systems use a severity field by default which overrides the ES calculated severity. Where this is not desired, it is worth renaming the field in the logs to something like:
...|rename severity as orig_severity
... View more
09-17-2018
06:08 AM
We have several lookup files for users who have left, and we would like to transfer the ownership to a new production user that we have created for the purpose. Any idea how to do this?
For other knowledge objects this can be done in settings > All Configurations > Reassign Knowledge Objects, but lookups do not seem to be included in this list.
Splunk 6.6.5
ES: 4.7.4
... View more
05-31-2018
06:20 AM
How about:
... mysearch |lookup lookupname lookupnamefield OUTPUT lookupnamefield as dummy|where isnotnull(dummy)
... View more
03-08-2018
06:27 AM
Nope, they run at scheduled intervals, and if the event feed is delayed, things can be missed.
... View more
03-08-2018
02:06 AM
Just did a little reading into this approach, and I think you are right, as shown in the example from the rest api page:
curl -k -u admin:pass https://localhost:8089/services/saved/searches/Purchased%20products%2C%20last%2024%20hours/reschedule -d schedule_time=2012-08-15T14:11:01Z
... View more
03-08-2018
01:33 AM
How would this work for effectively looking at the missed data from the restored feed? Surely that command would only run the search now, not step back through the data? Or am I missing something obvious (admittedly, highly likely)?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-12-2021
12:17 PM
|
Karma given to
