Hello! I am experiencing troubles with analyzing Threat Intelligence data in Enterprise Security.  When I go to Security Intelligence -> Threat Intelligence -> Threat Activity, here is Threat Activity Details panel.  It would be great if you can help me with the following questions: 1) The data for this panel it taken from Threat Intelligence datamodel (threat_activity index).  As I undersand correctly,  threat_activity index is filled with the help of all these searches (Certificates Intelligence, Email Intelligence, etc.) Can you please show me the example how to add some more data to this index, because I would like to receive the information not only about the threat match field, but also about the Data Model (from where the threat match field came from), about the type of data (rec_type_simple), src and dest ports, etc. 2) Here in Threat Activity Details panel we have a field threat_group (misp_es_domain_intel, misp_es_ip_intel). If you are aware please tell me where I can change this field (I would like to add a pipe delimited field  from lookup, so that it looks like misp_es_domain_intel | CERT). I have reviewed the full search already, which forms Threat Activity Details panel, but but here are a lot of macros and I get lost where exactly I should change the threat_group field. ... View more

Hello, guys, I`m collecting logs from VMware Horizon client and here are 2 fields, the meaning of which I don`t clearly understand. Is this length in seconds, minutes, hours?   And 2ond question: Maybe someone tried to calculate the session duration of Horizon logins and logons. Because here can be not only situations of simple logon and logoff , but also when the session was timed out and then the user reconnects. In ideal version I would like to check how many hours does the user spend using Horizon agent per day (to control working hours). ... View more

When I create simple basic search (throught index) for events, I get such amount of results All events are tagged, and therefore should be in a datamodel (as I understand correctly, this is the only way for events to go to datamodel) But when I search a datamodel for these events, the amount is different   What can be the reason? ... View more

I want to extend the results of the first search : add the column category  (from the 2 search) to the results of the 1 search. The results of the first search appear: The results of the 2 search are also present:  2 datasets have one common field dns_query  . But using join command no matches are found in these 2 datasets are found (it`s impossible, because I checked some of the dns_query )         Any ideas what can be wrong? ... View more

Can anybody help me to create props.conf and transforms.conf files to correctly parse such logs?     "2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines","Networks","Networks","" "2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines,Malware","Networks","Networks","" "2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines,Malware, Network","Networks","Networks","" "2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Malware","Networks","Networks",""      As you see, here the log with the category field "Search Engines,Malware" should belong to both categories: Search Engines and Malware. So, the category field can consist of 1, 2, 3 or more values. ... View more

Hello, guys I`m trying to extract URL field from my log in Data Model (it is not extracted from _raw log and is not seen via index). I have found some variants in similar topics and added a new field (with regular expression) to Data Model. It does not cover 100% of my events, but it works. However, I still don`t see this field when run the command | from datamodel Network_Traffic 2 questions:   1) Can anyone answer me why the field is still not seen when whiting the search | from datamodel Network)Traffic Because the "Preview" tab shows the results and URLs are extracted    2) Maybe you know how I can extract the field URL directly from _raw event, because I`m confused with all answers which I saw about this topic before.   Tranks in advance ... View more

When attempting to use the alert action from Splunk the The Hive it appears to fail with the following error: Configuration of lookup tables: thehive_datatypes.csv: default thehive_instance_list.csv   Everything was done according to manual: https://github.com/remg427/TA-thehive-ce/blob/master/docs/thehivealerts.md Any idea what can be wrong? ... View more