Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Aleena
Aleena
Explorer
Member since:
08-11-2020
03-08-2024
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 08-11-2020 |
Activity Feed
- Posted Windows log having special characters when received in HF and Indexer- Air gapped environment on Getting Data In. 08-28-2023 03:31 AM
- Tagged Microsoft cloud service add-on: Onboarding VM logs? on All Apps and Add-ons. 11-03-2022 02:20 AM
- Tagged Microsoft cloud service add-on: Onboarding VM logs? on All Apps and Add-ons. 11-03-2022 02:20 AM
- Posted Microsoft cloud service add-on: Onboarding VM logs? on All Apps and Add-ons. 11-03-2022 02:18 AM
- Tagged Microsoft cloud service add-on: Onboarding VM logs? on All Apps and Add-ons. 11-03-2022 02:18 AM
- Tagged Microsoft cloud service add-on: Onboarding VM logs? on All Apps and Add-ons. 11-03-2022 02:18 AM
- Posted Is it possible to forward logs from azure private cloud to splunk cloud using "Microsoft cloud services add-on"? on Splunk Cloud Platform. 10-02-2022 07:41 PM
- Posted Can I forward logs from event hub in Azure Cloud not publicly accessible into Splunk via the Microsoft Cloud add on? on Splunk Cloud Platform. 09-30-2022 02:20 AM
- Posted Re: Wineventlogs Forwarding without AD on Deployment Architecture. 06-13-2022 03:00 AM
- Posted Re: Wineventlogs Forwarding without AD on Deployment Architecture. 06-13-2022 02:52 AM
- Posted Why are Wineventlogs Forwarding without AD? on Deployment Architecture. 06-13-2022 02:40 AM
- Posted Re: How to capture attack signature of Symantec EPO server in Splunk? on Security. 06-15-2021 06:22 PM
- Posted Re: How to capture attack signature of Symantec EPO server in Splunk? on Security. 10-07-2020 07:40 PM
- Tagged Re: How to capture attack signature of Symantec EPO server in Splunk? on Security. 10-07-2020 07:40 PM
- Posted Re: Use case to detect malicious activity in Splunk indexer which is in a weak network on Security. 08-13-2020 07:07 PM
- Karma Re: Use case to detect malicious activity in Splunk indexer which is in a weak network for shivanshu1593. 08-13-2020 07:05 PM
- Posted How to capture attack signature of Symantec EPO server in Splunk? on Security. 08-13-2020 12:47 AM
- Posted Re: Use case to detect malicious activity in Splunk indexer which is in a weak network on Security. 08-12-2020 06:55 PM
- Posted Re: Use case to detect malicious activity in Splunk indexer which is in a weak network on Security. 08-12-2020 06:32 PM
- Karma Re: Use case to detect malicious activity in Splunk indexer which is in a weak network for shivanshu1593. 08-12-2020 06:31 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-28-2023
03:31 AM
Hi there, we have setup splunk in airgapped environment. Windows forwarding log to HF via UF agent port 9997. HF then forwards the log to indexer rsyslog via data diode. We are receiving logs in indexer which is having special characters. Can anyone know how to troubleshoot this? Thankyou in advance @splunk
... View more
Labels
- Labels:
-
heavy forwarder
-
indexer
-
Windows
11-03-2022
02:18 AM
Hi there,
Anyone pls advice how to onboard VM logs and Bastion logs from Azure to Splunk. I have installed the add on microsoft cloud services but am only receiving metrics log from these bastion event hub and VM event hub. Please let me know how to get VM logs and Bastion logs from azure to Splunk
thanks in advance
... View more
Labels
- Labels:
-
configuration
-
installation
10-02-2022
07:41 PM
Hi There,
Is it possible to forward logs from azure private cloud to splunk cloud using "Microsoft cloud services add-on"
Thanks in advance
... View more
Labels
- Labels:
-
using Splunk Cloud
09-30-2022
02:20 AM
Hi there,
Is it possible to forward the logs from event hub in azure cloud which is not publicly accessible into Splunk via the Microsoft cloud service add-on?
Thanks in advance!
... View more
Labels
- Labels:
-
configuration
06-13-2022
03:00 AM
Hi @gcusello WMI involves domain user account and i dont have AD or domain controller. so cannot use it. Thankyou
... View more
06-13-2022
02:52 AM
Hi @gcusello Thanks for ur prompt response. i cannot able to install any agent on my windows server. already tried installing UF but i keeps failed. I want an agentless approach. Thankyou,
... View more
06-13-2022
02:40 AM
Hi There,
I am having windows server 2008 without AD. would like to forward wineventlogs from windows server 2008 to Heavy forwarder running on Linux. Have tried
1. Native WEF
2. Syslog-Ng
3.NXLog
All are not working since it all requires domain subscription and i dont have AD. Have written powershell script to export wineventlogs but dont know how to forward this log to HF running on RHEL. Kindly let me know how to proceed.
Thanks in Advance
... View more
- Tags:
- winlogevets
Labels
- Labels:
-
forwarder management
-
Windows
06-15-2021
06:22 PM
hi Shivanshu, Thanks for getting back to me. I will check whether we have enable audit log from Mgmt server. And we are using UF/HF for forwarding logs to Splunk. Thankyou, Aleena
... View more
10-07-2020
07:40 PM
Hi S, Thanks for getting back to me. We don't have attack signature field in raw log.. we only receive the following raw log from Symantec. Please let me know what log we have to pull from Symantec to get attack signature field. 2020-10-08T07:20:42+08:00 Abc(ip address) Oct 8 07:30:15 xyz (hostname) SymantecServer: Site: My Site, Server Name: xxxx, Domain Name: Default,The management server received the client log successfully Xxx(username) Thankyou, A
... View more
- Tags:
- security
08-13-2020
07:07 PM
Hi @shivanshu1593 Really appreciate your help. was impressed by your answers. sure will try to install ES content app. Thanks a lot. Have a nice day. Regards, Nafila Afrin
... View more
08-13-2020
12:47 AM
Hi Team, I need to create a use case with the field "attack signature" from Symantec logs. i already have Symantec log but that does not have attack signature field. Do i need to enable anything in logging? How can i achieve the above scenario? Thanks in Advance🙏
... View more
- Tags:
- symantec
Labels
- Labels:
-
other
08-12-2020
06:55 PM
Hi @shivanshu1593 Thanks for your reply. yes i agree, MITRE framework is a very good solution for Detection of attacks. For MITRE framework app, do i need to install the app to get the usecase along with SPL? Thanks in advance😊
... View more
08-11-2020
06:43 AM
Hi All, kindly give your thoughts on below questions. 1.How to create high level use case to detect malicious activity in Splunk indexer which is in a weak network ? what are the log source can be considered? 2.How to create high level use case to detect malicious activity in base OS of Splunk?what are the log source can be considered? Thankyou
... View more
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-08-2024
10:12 AM
|
