Hi Dfigurello, Pls, help me to know how to check index=msad. Thanks Pro, Khai ... View more

This is file inputs config of Splunk_TA_Window. Please check for me about this file? [WinEventLog://Application] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 [WinEventLog://System] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 DHCP [monitor://$WINDIR\System32\DHCP] disabled = 0 whitelist = DhcpSrvLog* crcSalt = sourcetype = DhcpSrvLog Windows Update Log [monitor://$WINDIR\WindowsUpdate.log] disabled = 0 sourcetype = WindowsUpdateLog File system change monitor [fschange:$WINDIR\System32\drivers\etc] disabled = 0 hashMaxSize = 1048576 pollPeriod = 30 Scripted Input (See also wmi.conf) [script://.\bin\win_listening_ports.bat] disabled = 0 Run once per hour interval = 3600 sourcetype = Script:ListeningPorts [script://.\bin\win_installed_apps.bat] disabled = 0 Run once per day interval = 86400 sourcetype = Script:InstalledApps [script://.\bin\win_timesync_configuration.bat] disabled = 0 interval = 86400 sourcetype = Script:TimesyncConfiguration [script://.\bin\win_timesync_status.bat] disabled = 0 interval = 7200 sourcetype = Script:TimesyncStatus Splunk 5.0+ Performance Counters CPUTime [perfmon://CPUTime] counters = % Processor Time;% User Time disabled = 0 instances = _Total interval = 10 object = Processor Disk [perfmon://FreeDiskSpace] counters = Free Megabytes;% Free Space disabled = 0 instances = * interval = 10 object = LogicalDisk Memory [perfmon://Memory] counters = % Committed Bytes In Use;Available Bytes;Committed Bytes disabled = 0 interval = 10 object = Memory Network [perfmon://LocalNetwork] counters = Bytes Received/sec;Bytes Sent/sec;Bytes Total/sec;Current Bandwidth disabled = 0 instances = * interval = 10 object = Network Interface Thanks ... View more

Perhaps you should look at scripted alerts... here There are couple of other question you should also look at for hints ... http://splunk-base.splunk.com/answers/3019/scripted-alert-question AND http://splunk-base.splunk.com/answers/40843/alerting-send-ipuser-to-script-as-a-parameter But generally you should also look to support/forums for your firewall vendor for the actual script sections that will be needed to add firewall rules to the access list. Hope this helps, MHibbin ... View more

Thanks for your supports. I have found results of my search follow your guide.! ... View more