About Suirand1

Suirand1 · ‎09-19-2021

I am in the same situation. Endpoint filesystem datamodel has file_hash and file_name values. I do see those values uploaded to Threat artifacts dashboard succesfully. However threatintell is not hitting it for some reason. Any help would be apreciated.

Suirand1 · ‎09-17-2021

I am in the same situation. Endpoint filesystem datamodel has file_hash and file_name values. I do see those values uploaded to Threat artifacts dashboard succesfully. However threatintell is not hitting it for some reason. Any help would be apreciated.

Suirand1 · ‎03-19-2021

I am having the same problem too

Suirand1 · ‎03-02-2021

I am having the same situation with the same error message.

Suirand1 · ‎02-05-2021

I installed Add-on installed FortigateAPP for splunk. Enabled data model acceleration. "Traffic dashboard" is showing results, however Overview dashboard is empty. Most of the macros searches is not returning any results. I am ingesting fortigate logs via SC4S, by default they goes to "netfw" - index, SC4S-source, fgt_traffic -sourcetype. I also added local/props.conf for Add-on : [fortinet] TRANSFORMS-force_sourcetype_fgt = force_sourcetype_fgt_traffic,force_sourcetype_fgt_utm,force_sourcetype_fgt_event SHOULD_LINEMERGE = false Any ideas why macros are failing?

Suirand1 · ‎01-25-2021

Suirand1 · ‎01-14-2021

I suppose you wanted to say in "server.conf" instead of "web.conf". I do get these errors even after configurig sslRootCAPath in server.conf

Suirand1 · ‎07-28-2020

Indexer and search head is the same VM. Common Information Model app along with SA-cim_vladiator are installed. Do not know how to debug. Is there any additional configuration needed for my setup and SSE app? P.S. I have noticed in DATA Inventory dashboard that my products "Status" do not get "Completed". It allways stays in "Analyzing CIM and Event Size" status.

Suirand1 · ‎07-28-2020

I am very new to Splunk. Using Universal forwarder I send windows application, security, system, sysmon logs to SSE app. I followed SSE provided all data onboarding guides for indexes , sources, sourcetypes configuration. I successfully run automated introspection in data inventory dashboard. However when i run CIM Compliance Check I get only 2 compliant fields for Microsoft products. SPL searches also fail since I am missing some fieldnames which are provided in Security content. I have TA-windows and TA-sysmon installed in UF and Searched. Logs gets parsed as XML data by these TA If I understand correctly I am missing some CIM datamodel. Could you explain where to find and how to apply the right CIM data model for this app.

Posts	9
Solutions	0
Karma Given	4
Karma Received	2
Member Since	‎07-28-2020

Online Status	Offline
Date Last Visited	‎09-22-2021 01:44 PM

SSE v3.1.2 CIM compliance check returns only 2 com...

Re: Upload Threat Intelligence not working

Re: Why is "Threat file_intel" not capturing hash ...

Re: 500 Internal Server Error when I click "Manage...

Re: Security Essentials CIM Compliance Check error

Re: Fortinet Fortigate App for Splunk Empty Dashbo...

Re: Windows Process Name inputs.conf Blacklisting ...

Re: Getting mutiple issues when enabling ssl on Sp...

Re: SSE v3.1.2 CIM compliance check returns only 2...

SSE v3.1.2 CIM compliance check returns only 2 com...