About Jhunter

Jhunter · ‎12-09-2020

For assets I believe these are the src_ fields that match the asset header such as src_should_update src_is_expected

Jhunter · ‎12-09-2020

Another (slightly crude) way is on your fields side bar for sourcetypes that have asset/identity fields (such as user) extracted, you should see the user_ fields with each user header (example: user_email, user_nick, user_first).

Jhunter · ‎12-09-2020

Hi Abhi, The difference between the two lookup-addition locations is: Configure > Data Enrichment > Identity Management = This is specifically for adding asset/identities lists that adhere to the ES headers (https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Formatassetoridentitylist) When you add something here, the lookup table gets added to the `asset_sources` macro which is used in the pipeline to generate the final assets list used to automatically correlate the asset data to events Configure > Content > Content Management > Create New Content > Managed Lookup = This is for general lookup tables that do necessarily have to do with identities/assets management Ideally, you want to define Category/Priority in your asset generating search (Such as LDAP or SecKit). So in theory you could utilize a lookup command with your special lookup table to define Priority and Category for these assets in the asset generating search. That way you can have one master asset list in Identity Management with the correct Categories and Priority. Hope this helps, even if a little.. Joey

Jhunter · ‎09-16-2020

Possibly use the rest command combined with Rich's internal search: (taken and edited from: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Listcorrelationsearches) | rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",") | fields title, search, updated The Updated field represents when the correlation search was updated (changed) - I tested this on my own instance. So, you could keep a list of enabled searches with their update times in a lookup table using that rest search. Then in a new correlation search compare the current rest results with the historic lookup table and if the update times are different - there was a change. Then in the drill down of the correlation search you could pass the name of the search as a token and update time (using maybe earliest= and latest= in the search SPL with that token) and search on the internal index via Rich's search or something similar to find the user who made the change.

Jhunter · ‎09-04-2020

The only thing I can think of is a new correlation search (or scheduled search - an Alert with email as trigger actions) that looks at the incident_review.csv (or the macro `incident_review` which has better context) and tracks status changes for notables going from 1 to 5. One way without thinking about the logic too deeply is to create a new CSV with all notables with unclosed status (coming from the incident_review.csv) Have the search run every 5-15 minutes (it shouldn't be resource intensive) and use a lookup command against incident_review.csv and look for where one of the unclosed notables has changed to a closed status. Hope this helps..

Jhunter · ‎08-29-2020

This is expected behavior as ES stores a correlation search's notable event severity in lookup table (correlationsearches_lookup) so the severity gets changed for all. Use SPL in the correlation search to assign severity: https://docs.splunk.com/Documentation/ES/6.2.0/User/Howurgencyisassigned "Severity defined in the search syntax results in an event where severity takes precedence over the severity defined in the notable event adaptive response action." If you just want all new notables from this use case to be high (and not old ones) just use a an eval. Or you can expand on the eval to custom adjust the severity: | eval severity="high" Even if you're using the datamodel command or tstats against a data model, you can still fit this in a pipe somewhere without affecting the searching tstats count something FROM someDataModel by somethingElse | where other stuff and magic | eval severity="high"

Jhunter · ‎08-29-2020

I will take a stab - Doing a search on `notable` - I don't see the severity field in the raw notable logs. This lead me to believe that severity is probably in a lookup table somewhere. I found a lookup table correlationsearches_lookup that I found the severity field is stored in. It would make sense that when you change the severity in content management, all notable events would be changed. as the Urgency would be derived from this severity. For a solution see this: https://docs.splunk.com/Documentation/ES/6.2.0/User/Howurgencyisassigned You can manually calculate the severity in the SPL of the correlation search which according to that document: "Severity defined in the search syntax results in an event where severity takes precedence over the severity defined in the notable event adaptive response action." So in your password violation scenario you could do something like (pseudo code): eval rightNow=now() [get running time stamp] eval severity=case(rightNow later than noon, "high", rightNow earlier than noon, "informational)

Jhunter · ‎08-29-2020

(A bit off your specific question but perhaps helpful) The use case library - has data dependencies listed for use cases https://docs.splunk.com/Documentation/ES/6.2.0/Admin/Usecasecontentlibrary

Posts	8
Solutions	4
Karma Given	0
Karma Received	3
Member Since	‎08-29-2020

Online Status	Offline
Date Last Visited	‎01-24-2021 06:25 PM

Re: Whats the best way to verify Identity and Asse...

Re: Whats the best way to verify Identity and Asse...

Re: Splunk ES cannot see data from Custom lookup

Re: How can we track changes made in Correlation s...

Re: Send email on Notable Event close action

Re: ES notable urgency changing for old notables.

Re: Why does modifying notable severity in Splunk ...

Re: How to get a complete list with descriptions o...