Hi, I am trying to figure out a way in which i can display the creation time of notable event, the time it was assigned to someone, and then the time the status was set to Closed. I would then like to list the time difference between all 3 - it is for SLA purposes in our SOC. Note: When notables are created in my environment, the default status is "New" Seen some examples that produce the mean/average closure time for notables etc, but I am looking for a search that will show it for every notable created (say within the last 24 hours for example) Any help would be much appreciated!   ... View more

Hi,  I have the Forescout Technology Add-on and the Forescout Adaptive Response Add-on installed on my ES SH. The integration is working fine in respect to retrieving events from Forescout, however I am having a problem with the Adaptive Response Add-on. I installed the Add-on but when i restart the ES SH it gives an error message (screen shot attached). When i go into /opt/splunk/var/log/splunk and check the log file TA-forescout_response_init.log, it shows ... [splunk@dub2splk203 splunk]$ tail TA-forescout_response_init.log 2021-11-03 15:42:29 - fsct_rest_api_wrapper.py:30 - INFO - Posting new message to bulletin. 2021-11-03 15:42:29 - fsct_rest_api_wrapper.py:44 - DEBUG - REST API request succeeded 2021-11-03 17:15:17 - ta_forescout_response_init.py:35 - DEBUG - Initializing app: [TA-forescout_response]... 2021-11-03 17:15:18 - fsct_ar_actions_reader.py:34 - INFO - Read usessl: [1], verify_cert: [1] from app: [TA-forescout] 2021-11-03 17:15:18 - fsct_ta_config_reader.py:59 - DEBUG - Getting credentials configured in app: [TA-forescout]. 2021-11-03 17:15:18 - fsct_ar_actions_reader.py:38 - INFO - Read fsct_emip: [dub2fst202.syncreon.local] from app: [TA-forescout] 2021-11-03 17:15:18 - fsct_ar_actions_reader.py:56 - DEBUG - Action url: https://dub2fst202.syncreon.local/splunk/actions_info?auth=CounterACT%20 2021-11-03 17:15:18 - ta_forescout_response_init.py:41 - CRITICAL - Error while getting alert actions from CounterACT: Unsuccessful Actions Info API call. Invalid status: [401] or request ID mismatch 2021-11-03 17:15:18 - fsct_rest_api_wrapper.py:30 - INFO - Posting new message to bulletin. 2021-11-03 17:15:18 - fsct_rest_api_wrapper.py:44 - DEBUG - REST API request succeeded There is no problem with regards access to my CounterAct server (on-prem) as I verified that the HTTPS connection can be made. Has anybody have any experience with this add-on or this error, as Im kind of lost and there is very little from Forescout on this? Thanks! ... View more

Hi,  I am using the Threat Intelligence datamodel in my Splunk ES environment. It is being populated with a Threat Intel Feed source. I would now like to check if certain values from my searches exist in the data model, so i can enrich correlation searches etc. I basically want to my searches to lookup the data model and output if the value exists or not, along with the matched value. For example,  i have a field named url  which will be returned from the following search: index="cisco_fmc" rec_type_desc="File Malware Event" eventtype=cisco_fmc_malware disposition=Malware I now want to add SPL to the above so it looks up the value of url  against the Threat Intel datamodel. The datamodel contains the standard two fields - threat_match_field which can be url, and threat_match_value which is the associated value. If present, I would like to add a new field to the output named match which should be set to "Yes" if present and "No" if not. Would also like to output the threat_match_value  itself to the output. Thanks. ... View more