Hi, Notable events in ES can now be assigned Dispositions. I am able to create new Dispositions from the Incident Review page and enable/disable them. From the reviewsettings.conf file i can also set a default one, set it to Hidden etc. However I am looking see if there is a way for Dispositions are required to be set when anyone edits a notable event from the Incident Review tab. I want to have "Unassigned" as the default one. But then require any of the others to be assigned when a notable is edited. Kind of similar to the way Comments can be set to Required. Basically i need them to be mandatory. Anyone know of a way to do this? ... View more

Hi, I am trying to figure out a way in which i can display the creation time of notable event, the time it was assigned to someone, and then the time the status was set to Closed. I would then like to list the time difference between all 3 - it is for SLA purposes in our SOC. Note: When notables are created in my environment, the default status is "New" Seen some examples that produce the mean/average closure time for notables etc, but I am looking for a search that will show it for every notable created (say within the last 24 hours for example) Any help would be much appreciated!   ... View more

Hi,  I have the Forescout Technology Add-on and the Forescout Adaptive Response Add-on installed on my ES SH. The integration is working fine in respect to retrieving events from Forescout, however I am having a problem with the Adaptive Response Add-on. I installed the Add-on but when i restart the ES SH it gives an error message (screen shot attached). When i go into /opt/splunk/var/log/splunk and check the log file TA-forescout_response_init.log, it shows ... [splunk@dub2splk203 splunk]$ tail TA-forescout_response_init.log 2021-11-03 15:42:29 - fsct_rest_api_wrapper.py:30 - INFO - Posting new message to bulletin. 2021-11-03 15:42:29 - fsct_rest_api_wrapper.py:44 - DEBUG - REST API request succeeded 2021-11-03 17:15:17 - ta_forescout_response_init.py:35 - DEBUG - Initializing app: [TA-forescout_response]... 2021-11-03 17:15:18 - fsct_ar_actions_reader.py:34 - INFO - Read usessl: [1], verify_cert: [1] from app: [TA-forescout] 2021-11-03 17:15:18 - fsct_ta_config_reader.py:59 - DEBUG - Getting credentials configured in app: [TA-forescout]. 2021-11-03 17:15:18 - fsct_ar_actions_reader.py:38 - INFO - Read fsct_emip: [dub2fst202.syncreon.local] from app: [TA-forescout] 2021-11-03 17:15:18 - fsct_ar_actions_reader.py:56 - DEBUG - Action url: https://dub2fst202.syncreon.local/splunk/actions_info?auth=CounterACT%20 2021-11-03 17:15:18 - ta_forescout_response_init.py:41 - CRITICAL - Error while getting alert actions from CounterACT: Unsuccessful Actions Info API call. Invalid status: [401] or request ID mismatch 2021-11-03 17:15:18 - fsct_rest_api_wrapper.py:30 - INFO - Posting new message to bulletin. 2021-11-03 17:15:18 - fsct_rest_api_wrapper.py:44 - DEBUG - REST API request succeeded There is no problem with regards access to my CounterAct server (on-prem) as I verified that the HTTPS connection can be made. Has anybody have any experience with this add-on or this error, as Im kind of lost and there is very little from Forescout on this? Thanks! ... View more

Hi, My Splunk environment is on-prem. I have a single IDX which runs RHEL on a physical stand-alone server. Indexes are stored on a RAID 5 disk configuration on the same server. My disk is starting to fill up and I was wondering if is is possible to manually delete older warm bucket files on my IDX (basically running an rm linux command)? The indexes in question are not being used/written to any more, so I dont need to search/access them again. Is this OK to do? Will it create any inconsistency issues or errors in my Splunk env? Thanks.  ... View more

Hi, I am looking to compare a field value against the results of an ldapsearch to check whether the value is present or not. The Use Case is basically that I want to detect if a cloud user account is created in our O365 environment, and that same user name does not exist in our on-prem Active Directory. I have the below SPL which returns newly created users in my O365 environment. The below returns a field named "user". index="o365_log" action=created command="Add user." I now want to search my Active Directory domain to see if this user exists or not. If it doesnt exists in Active Directory, I want the search to detect it and output the user name.  I am using ldapsearch and searching where the userPrincipleName is the same as the value of the user field. The SPL below is what I am using: | ldapfilter domain=default search="(userPrincipalName=$user$)" attrs="cn,userPrincipalName"  The above SPL works, however the problem I have is that Im not sure how to combine these two lines SPL together so that it performs the check and only output' users which are not found from the ldapsearch. Can somebody help? Thanks.  ... View more

Hi,  I am using the Threat Intelligence datamodel in my Splunk ES environment. It is being populated with a Threat Intel Feed source. I would now like to check if certain values from my searches exist in the data model, so i can enrich correlation searches etc. I basically want to my searches to lookup the data model and output if the value exists or not, along with the matched value. For example,  i have a field named url  which will be returned from the following search: index="cisco_fmc" rec_type_desc="File Malware Event" eventtype=cisco_fmc_malware disposition=Malware I now want to add SPL to the above so it looks up the value of url  against the Threat Intel datamodel. The datamodel contains the standard two fields - threat_match_field which can be url, and threat_match_value which is the associated value. If present, I would like to add a new field to the output named match which should be set to "Yes" if present and "No" if not. Would also like to output the threat_match_value  itself to the output. Thanks. ... View more

Hi,  I am trying to configure the TA-QualysCloudPlatform add-on, but I am getting an error when im trying to configure the add-on. I have installed it on my HF. When I enter the Qualys API Server url and enter the username and password, and then hit save it gives me the following error ERROR: In handler 'passwords': Does not exist: /nobody/TA-QualysCloudPlatform/passwords/credential::splunk_ta_o365_syncreon_0365_client_secret: I am entering the correct username and password. But even if i enter any password it still gives the error. From reading other articles on this add-on, there has been issues in the past with the add-on not overwriting older saved credentials but it seems that it is not the issue here as the credentials are not even being saved. (There is no passwords.conf being written to the /local folder) Also, there is no logs written to the /var/log/splunk/ta-QualysCloudPlatform.log log file. The file is empty. So i cant troubleshoot any errors. I am running the lastest version of the add-on - 1.8.8, and have even tried using older versions (as far back as 1.8.3) but the problem still occurs. Does anyone know why this is happening? Thanks! ... View more

Hi,  I am using the Solarwinds Add-on. I have it installed on my HF and it is working fine. However there is one sourcetype (out of the 3) which the timestamp is not correct - it is named "solarwinds:alerts". It appears to be one hour behind the other sourcetypes. It looks to be GMT when it should be GMT+1. I have created a new props.conf file in /etc/splunk/apps/Splunk_TA_Solarwinds/local/ directory of the HF instance . In this file I have added: [sourcetype::"solarwinds:alerts"]                                                                                                                                                      TZ = GMT+1 I saved the config, restarted the HF and search for the events of this sourcetype but they still appear to be off by one hour and the TZ setting doesnt seem to be working. Researching online, this seems to be the standard way to set a timezone. Is there something I am doing wrong? Thanks! ... View more

Hi  I installed the Alerts Manager app as I was hoping to have better features to view and manage my incidents and alerts in enterprise security. I installed the app (id:2665) and the add-on (id3665) to my SH, created a new index named alerts and completed the set up.  However there are no Incidents or Alerts showing in any of the dashboards. My understanding was that this app would pull the incidents/alerts from ES so I can manage them? But nothing is showing In the app, i can create a new incident no problem and can see it being added to the new "alerts" index, but this isn't much use to me. Is there something im missing here regarding this app or its purpose?? Thanks ... View more

Hi, I have a field named operating_system. it can contain multiple values examples being "Windows 10", "Windows Server 2016", "Windows 7" and others. I want to set a field named os_group based on the value of operating_system. So if the value operating_system value contains "Windows Server*" i want to set the os_group to "Server". If the value of operating_system is "Windows 7", "Windows 8", or "Windows 10", I want to set os_group to "Workstation" I was trying to do it using seperate lines as below. But can i combine these into one eval function where i can specify multiple values to filter on? I will need to use wildcards. | eval os_group=if(like(operating_system, "%Server%", "Server", os_group) | eval os_group=if(like(operating_system, "%Windows 7%", "Workstation", os_group) Thanks ... View more