About rupalekar

spectrum2035 · ‎06-26-2019

We use Crowdstrike app which works perfectly fine (sending data on Test environment). The only CEF format i have used it in the past is from CyberArk. https://docs.splunk.com/Documentation/AddOns/released/CyberArk/Setup You can refer the above document.

rupalekar · ‎06-11-2019

Hi Thanks for your reply. Those settings were already correctly in place. Any other ideas on what should be checked ? Thank you!

rupalekar · ‎06-10-2019

Any Guesses?

kchamplin_splun · ‎06-06-2019

There's documentation here that has pretty solid detail: https://my.phantom.us/4.2/docs/admin/splunk sign up for an account at phantom.us - it's free. However, the TL;DR is, in order to export data via a data model search, you need datamodels defined in your Splunk instance/search head - those datamodels will then have "objects" in them which should "un-grey out" the "select object" field. If you want a quick test, install the Splunk Common Information Model (CIM) app on your Splunk instance. Restart splunk after install and see if the dropdown is still grey'd out. https://splunkbase.splunk.com/app/1621/

Posts	6
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎05-31-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

CEF Format Crowdstrike Data to Splunk

Connection Between Phantom and Splunk

Playbook Having Issues executing

Forwarding Data between Splunk ES and Phantom

Re: CEF Format Crowdstrike Data to Splunk

Re: Connection Between Phantom and Splunk

Re: Playbook Having Issues executing

Re: Forwarding Data between Splunk ES and Phantom

Join the Conversation