About cachexploit

cachexploit · ‎05-02-2022

After doing some more digging it appears that the machines logging into Splunk have IPv6 enabled BUT the sources connecting to those machines do not have IPv6 enabled. So there is the address reporting ::ffff:10.10.10.10, basically stating to the Splunk UF machine that this source is working in IPv4. What I am looking for is how to alter the group logging of these machines so that Splunk parses them correctly and I drops the IPv6 part of this address?

cachexploit · ‎04-27-2022

I am getting IPv6 with collapsed zero's and IPv4 quad (ie "fe80::192.168.10.100") for source and I want to parse out the IPv6 part of that field. What do I need to add in my prop to parse that part out? Thank you for any and all help.

cachexploit · ‎02-18-2021

I have reviewed these and I am trying to combine them in ONE chart. More of a ROI for Splunk Enterprise. I want to show on a line chart (or a similar visualization) how many notables are created by ES and how many investigations we start (and eventually show how many we close). This is basically what I am trying to combine... index=notable |bucket _time span=day |stats count by _time AND | `investigations` earliest="-30d@h" latest="now" | `get_realname(creator)` | fieldformat create_time=strftime(create_time, "%c") | `uitime("mod_time")` | eval _time=create_time, id=title | `investigation_get_current_status` | `investigation_get_collaborator_count` | eval _time=create_time | timechart span=1d count by creator_realname

cachexploit · ‎02-18-2021

I want to show how many ES Notables were opened in the last 30 days and how many investigations were opened on a line chart. I can get the notable Index over the last 30 days, no problem but how do I add in the `investigations` to the same line chart? Here is the query I am using for the notables index=notable |bucket _time span=day |stats count by _time

cachexploit · ‎01-11-2021

Since I have gone through and tuned a lot of the Content in ES, I am looking to see if anyone knows of a Bulk way to add an Adaptive Response (as in send an email) for every Incident Created? I am at the point now where things are in a good place and I would not be overwhlemed with the amount of emails that would come in from the Incidents BUT now I want to send an email for every one that is created but I don't want to have to go through Content Management and set an adaptive response for EVERY SINGLE one that is enabled. For a little more info, I am using Splunk Cloud and ES. so any back end things I would have to submit a ticket to support (which I am not against doing, just want to make sure that is the route I need to go). TIA

cachexploit · ‎12-03-2020

So just as an update, we were able to get this to work through an F5 Loadbalancer and VIP. You have to make sure that there are no http profiles assigned to the VIP rule on the F5. Once we were able to do that, we can see that the Handshakes are being completed successfully and we see all the clients checking in throughout the day to all 3 deployment servers.

cachexploit · ‎09-16-2020

Splunk has confirmed themselves that this should work along with multiple posts in this community about the same architecture. I have a plan to roll out an abundance of UFs across our enterprise and was recommended this solution.

cachexploit · ‎09-16-2020

We setup 3 deployment servers behind a LB VIP. We set the VIP in deploymentclient.conf but for those agents we are not seeing them check in. We logged in locally to both a *nix and a Win machine and we can telnet to the VIP on port 8089. The LBer shows that traffic is being distributed between all three. Also, only our original DeploymentServer is showing clients, #2 and #3 do not show any clients at all. All serverclass.conf match and we have serverChecksum set to true in global. All of the app files are identical.

cachexploit · ‎09-04-2020

I have two apps installed on Windows clients. One looks like the full blown Windows_TA app and one looks like a truncated one. I worked with a PS to get all these apps initially installed. Everything in the full Win_TA looks to be disabled. The truncated one looks very simple and has some stanzas from the Win_TA app. I made a change to the truncated one (a blacklist addition) and I believe this has taken. Am I assuming correctly that the one app that has a truncated version of Windows TA is the actual app that is telling what logs for the Win hosts to send? Also, if my assumption are correct, is this common practice?

Posts	9
Solutions	1
Karma Given	1
Karma Received	0
Member Since	‎08-18-2020

Online Status	Offline
Date Last Visited	‎11-05-2022 12:19 PM

How do I parse IPv6 with collapsed zero's and IPv4...

Compare Notables (Index) vs Investigations

Bulk manage adaptive response (send email) for Con...

Multiple Deployment Server, VIP Load Balancer and ...

Windows_TA vs Windows

Re: How do I parse IPv6 with collapsed zero's and ...