Are you talking about human or hardware resources ? For hardware, have a look here: http://docs.splunk.com/Documentation/ES/5.2.0/Install/DeploymentPlanning By the way, I suggest you to run the indexers in physical servers instead of VM. ... View more

Many ways to anwser: Do manual test on specific use case Use intrusive testing tools Ask a pen testing company to do a intrusive test against your IT ... View more

Just to be sure, you configured the local input in ES here: Data inputs » Threat Intelligence Management » local_lookups ? ... View more

Hi, first, what version of ES are you using: 3.3 is an old release and you should look at the relevant doc version like this one: http://docs.splunk.com/Documentation/ES/5.0.0/Admin/UploadCSVthreatfile . That said, the file format should be the same. You should check if your threat list is correctly uploaded, either by looking in the Threat artifacts dashboards, either using this command: | inputlookup threatintel_by_cidr Next, validate that your src field from your event is correctly mapped to the CIM, and is used by ES. What kind of data do you want to match to ? ... View more

Hi Joon, you should be able to upgrade Spluk core to 7.0 and then upgrade ES directly to 5.0 ( http://docs.splunk.com/Documentation/ES/5.0.0/Install/Beforeupgrading ). Regards ... View more

How do you send your data ? If you send by syslog, some options on syslog server are sending data by block, not taking into account the end of the line to cut the blocks. ... View more

Hi, you need to have the relevant fields as output of your rule. For example if your look to some rules in ES, you might find things like this: ... | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" ... Feel free to post the search you're working on if you need more details. ... View more

I'm not sure there is a prefect answer for your question. By default, the fwd is designed to have a very limited impact on the system. You can limit the inputs to the ones that match your needs. You might also look at windows system features. Of course, you can monitor CPU usage in Splunk 🙂 ... View more

Hi David, Do you have any specific issues ? On which system ? When collecting what kind of data ? Can you give some details ? ... View more

Not at all ! Read all the answers and comments, and do not stop to the first one ! ... View more

Have a look here: https://answers.splunk.com/answers/31036/syslog-facility-and-severity-loglevel.html For color, use eventtypes: http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Defineeventtypes ... View more

A SOC and NOC are a combination of tools, processes, people. Splunk can be the tool for collecting data (logs, metrics, networks streams...) in order to monitor availability/performance and security (correlation, analytics, fraud...). It will be also a great tool for investigation in both cases. ... View more

Hum... it used to ! ... View more

So, when you go to ES app / Configure / Content Management, there is nothing in the Actions column, in any pages ? Have you done the ES setup ? Do you have any errors when you go to Settings / Monitoring Console / Health Check ? Any specific errors when you search index=_* ? ... View more

Hi, can you provide some details: What's happening when you try to enable them ? Is there an error message ? What version and OS are you running ? Do you have a Splunk license ? ... View more

Do you mean something with that kind of logic: tag=network | stats count(eval(action=="failure")) as failure, count(eval(action=="success")) as success by src | search failure > 100 success > 1 ... View more

Ah, you don't see any data at all in Splunk ? Even when looking for * ? Let's discuss this offline (I'll contact you by mail). ... View more

Humm... why the hell do you have the facility and severity at the begining of your log (AUTHPRIV.ALERT) ? Is this what your Splunk is receiving ? Can you share your syslogd config on your Great Bay device (I assume that in version 5 you must still configure it in the syslogd config file) ? ... View more

Hello, you need to set the sourcetype of your data as greatbay:beacon For example if your greatbay data is received at tcp port 514, your need to have a inputs.conf like this: [tcp://:514] sourcetype = greatbay:beacon If the sourcetype is correctly set, please put a few examples of your logs as saw by Splunk (and if possible your GreatBay version). ... View more

If the data has an TA that is CIM compliant, it will feed directly in ES (you can see in Splunk base if an app is CIM compliant or not). Otherwise, you will have to normalize the data by yourself. ... View more

Hello, As said before, the datagen, with some apps that contains samples will automatically generate data that will feed the datamodel. Otherwise, you can also try the demo sandbox here: https://www.splunk.com/getsplunk/es_sandbox . ... View more

Hi Laurent, The fwd (whatever version) can receive syslog streams, as any other fwd. keep in mind that if you do not need any functions from the Heavy fwd (web interface, advanced filtering), you should use the Universal fwd (even to act as a relay). ... View more

My advice: do not think about product, but think about your needs: what are the risk for your company, mainly the business ones ? Then, you will be able to identify scenarios you want to detect (for the correlation), check you want to do (for compliance), and what kind of anomalies you want to identify (for the analytic part). So SIEM is just a tool that does not answer all security needs. That said, you might have a look to ES documentation and look for .conf presentation for real use case. ... View more