About ngwodo

ngwodo · ‎03-08-2023

Thanks for your response. Here is my XML source code for the Dashboard below. I just want to show the details of one line of code when the access control e.g. "AC-1" depending on when the System name compliance status for each year or multiple years is either "high" or "medium" or "low" The source code is: <form version="1.1"> <label>RTM_Automation_030623_Global_David</label> <fieldset submitButton="false"> <input type="dropdown" token="system_tk" searchWhenChanged="true"> <label>System Selection</label> <fieldForLabel>System</fieldForLabel> <fieldForValue>System</fieldForValue> <search> <query>|inputlookup controls_rtm.csv |stats c by "System" |table "System" </query> <earliest>0</earliest> <latest></latest> </search> <choice value="*">All</choice> <default>*</default> </input> <input type="dropdown" token="cl_tk" searchWhenChanged="true"> <label>Control Library Selection</label> <fieldForLabel>Control_Library</fieldForLabel> <fieldForValue>Control_Library</fieldForValue> <search> <query>|inputlookup controls_rtm.csv |search "System"="$system_tk$" |stats c by "Control Library" |table "Control Library" |rename "Control Library" as Control_Library</query> <earliest>0</earliest> <latest></latest> </search> <choice value="*">All</choice> <default>*</default> </input> <input type="multiselect" token="year_tk" searchWhenChanged="true"> <label>Year OAM Selection</label> <choice value="Year 1 OAM">Year 1</choice> <choice value="Year 2 OAM">Year 2</choice> <choice value="Year 3 OAM">Year 3</choice> <delimiter>|</delimiter> </input> </fieldset> <row> <panel> <html depends="$alwayshideCSSPanel$"> <style> #tableColor table tbody td div.multivalue-subcell[data-mv-index="1"]{ display:none; } </style> </html> <table id="tableColor"> <title>Year Selection and Rating Results</title> <search> <query>|inputlookup controls_rtm.csv |search "System"="$system_tk$" "Control Library"="$cl_tk$" |table [|inputlookup controls_rtm.csv |search "System"="$system_tk$" "Control Library"="$cl_tk$" |fields - "System", "Control Library" |eval yearoam="$year_tk$" |makemv yearoam delim="|" |mvexpand yearoam |eval "FIPS199-Rating"=case('FIPS199-Rating'="H","High",'FIPS199-Rating'="M","Mod",'FIPS199-Rating'="L","Low") |eval yearoam=yearoam." ".'FIPS199-Rating' |table yearoam |eval yearoam="\"".yearoam."\"" |stats values(yearoam) as yearoam delim="," |nomv yearoam |rename yearoam as search], "Compliance Status" |eval color =case('Compliance Status'>=0 AND 'Compliance Status'<25,"LOW",'Compliance Status'>=25 AND 'Compliance Status'<100,"MEDIUM",'Compliance Status'=100,"HIGH") |foreach * [eval <<FIELD>>=mvappend('<<FIELD>>',color)] |fields - color,"Compliance Status"</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <format type="color"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette> </format> <drilldown> <set token="field_name">$click.name2$</set> <set token="field_value">$click.value2$</set> </drilldown> </table> </panel> </row> <row> <panel depends="$field_name$,$field_value$"> <table> <title>RTM Data Table</title> <search> <query>|inputlookup controls_rtm.csv |table Column* *</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">cell</option> <drilldown> <link target="_blank">/app/CIS_OA/rtm_automation_030623_global_david?form.year_tk=$click.value$</link> </drilldown> </table> </panel> </row> <row> <panel> <table> <title>RTM Test Methods</title> <search> <query>| inputlookup AssetD.csv | table *</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <drilldown> <link target="_blank">/app/CIS_OA/rtm_automation_030623_global_david?form.year_tk=$click.value2$</link> </drilldown> </table> </panel> </row> </form>

ngwodo · ‎03-07-2023

Please use below screenshot to determine what Splunk query that is needed to display the access control under the panel: "Year Selection and Rating Results" For example, when you click on "AC-7" that is yellow color, you should see in column fields the following which is: System, FISMA-ID, FIPS199-Categorization, FIPS199-Rating, Control Library, YearOA(if the system is high, medium or low) and Compliance status(if the system compliance is high, medium or low)

ngwodo · ‎11-15-2021

Please I need help with a detailed splunk Data accelerated data model authentication query for sucessful login alerts using a | tstats summariesonly=true . The query should have count threshold. The query should cover all products and vendors names used in the environment. It is not only successful login based on windows.

ngwodo · ‎10-26-2021

I have Mitre App for Splunk installed in my Enterprise security. I have the Mitre Dashboard up. I need help to create a repeatable process that will create custom content. I want to bring into the Mitre Dashboard "Detection Catalog" which was created by one of our Engineers. I need help on how I can automate or create a repeatable process of putting this custom data content into the Mitre Dashboard.

ngwodo · ‎10-16-2021

I have one 1 primary index namely azure with 2 sourcetypes namely: mscs:kube-good and mscs:kube-audit-good. I believe they could be duplication of data logs between the 2 sourcetypes. What is the splunk queries that can tell me if there is duplication of logs between the 2 sourcetypes. Do they each have information that the other doesn't contain. Is there a lot of overlap? Please give me the splunk queries that will do this job.

ngwodo · ‎10-13-2021

Pardon me. The parent screenshot I shared before was the wrong one. Below is actually the screenshot of the parent dataset: Please let me know.

ngwodo · ‎10-13-2021

The constraints for the Failed Authenication Data model is: (`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$) NOT "pam_unix(sshd:auth): authentication failure;" action="failure" I have another question. How can I review the event codes that are failing for windows authentication failures?

ngwodo · ‎10-12-2021

I created an Authentication data model that has default, Insecure, and Priviledge Authentication Data model. It also uses action=success and action=failures. Please see screenshot below: I can see the data coming in from different sources but the issue is that we have so many windows authentication failures. Please how can I fix this configurations issues? Has anybody come across such issues?

ngwodo · ‎10-12-2021

I have 2 major questions: 1) I have 2 Sourcetypes A and B with 2 important Fields Category and Enviroment. I want to compare all of the Category and Environment from Sourcetype A to Sourcetype B and then return Results that are common to both sourcetype. 2) I have 2 Sourcetypes A and B with 2 important Fields Category and Enviroment. I want to compare all of the Category and Environment from Sourcetype A to Sourcetype B and then return Results that does not show up on both sourcetypes.

ngwodo · ‎10-11-2021

Thanks for the above reply but what would be the eval expressions and field alias? Are mine going to have it for each of those authentication data model i.e. Default, Insecure and Privileged? Where will put the success and failure tags for the data model?

ngwodo · ‎10-11-2021

How will I set up a data model that has Authentication and sub-sessions Default, insecure and Privileged Authentication data model. It uses action of a sucess and failure. I am using the following splunk query: (`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$) NOT "pam_unix(sshd:auth): authentication failure;" Is there anything wrong with the above query or how can I make it to work?

ngwodo · ‎05-14-2021

Please I need detailed step-by-step processes on how I can deploy splunk apps and addons from the github(gitlab server) to doing it on the splunk deployment linux server(backend) and updating the changes in github. I know I should first log into gitlab and generate SSH keys and that this SSH keys is copied to our splunk deployment server(backend) in the command line. Please give me the detailed step-by-step process to accomplish this task.

ngwodo · ‎05-14-2021

Thanks. Please just another quick question. Which section in the ansible scripts will I put 1000 linux servers? Would I put in the scripts IP addresses or how will ansible know which machines to deploy splunk UF to?

ngwodo · ‎05-13-2021

Thanks. I will try those processes at some point. I am just gathering information on how to do it for now.. I thank you very much.

ngwodo · ‎05-13-2021

Please I need detailed step-by-step process on how I can install splunk universal forwarder on 1000 linux red hat servers using ansible. Is there any automated process to do it? Please how will you set up ansible playbook to do this task?

ngwodo · ‎01-07-2021

Please I need help with my splunk query below. My query below is only showing just one security metric based on my comparison. I have about 160 security metrics total but only seeing just one. Please I need your help with a splunk query that will show all the 160 security metrics based on my comparison below: index=security source=base_ad_metric_test_v3 earliest=-1y base_ad_metric>0 | stats avg(base_ad_metric) AS avg stdev(base_ad_metric) AS stdev min(base_ad_metric) AS min max(base_ad_metric) AS max latest(base_ad_metric) AS latest_count BY Metric_ID | eval min_thres=5000, max_thres=7500 | eval is_above_thres=if(latest_count>max_thres, 1, 0) | eval is_below_thres=if(latest_count<min_thres, 1, 0) | eval data_item_volatility=case(is_above_thres==1, "High", is_below_thres==1, "Low", true(), "normal") | lookup free_metrics.csv Metric_ID output Data_Item_volatility AS spreadsheet_Data_Item_volatility Operating_System_Metric_Calculation AS spreadsheet_Operating_System_Metric_Calculation Metric_Name AS spreadsheet_Metric_Name Please see below for the result of the security metric and explanation. The result is showing just one security metric right now. Our data source is from Active directory through AD managewise and is fed into splunk. The csv file is coming from external source in excel spreadsheet. The problem is that the excel spreadsheet has about 150 security metrics and my result is only showing just one metric. I need help with splunk query that will go through all the 150 metrics and do the comparison as seen from the above query and give me the result. Please see the result below: Metric ID avg stdev min max latest_count data_item_volatility is_above_thres is_below_thres 1 6145.32 330.95 4854 7319 5934 normal 0 0 max_thres min_thres spreadsheet_data_item_volatility spreadsheet_Metric_Name 7500 5000 Low Total # of GFE hardware assets spreadsheet_Operating_System_Metric_Calculation 5855

ngwodo · ‎01-07-2021

Please see below for the result of the security metric and explanation. The result is showing just one security metric right now. Our data source is from Active directory through AD managewise and is fed into splunk. The csv file is coming from external source in excel spreadsheet. The problem is that the excel spreadsheet has about 150 security metrics and my result is only showing just one metric. I need help with splunk query that will go through all the 150 metrics and do the comparison as seen from the above query and give me the result. Please see the result below: Metric ID avg stdev min max latest_count data_item_volatility is_above_thres is_below_thres 1 6145.32 330.95 4854 7319 5934 normal 0 0 max_thres min_thres spreadsheet_data_item_volatility spreadsheet_Metric_Name 7500 5000 Low Total # of GFE hardware assets spreadsheet_Operating_System_Metric_Calculation 5855

ngwodo · ‎01-07-2021

Please see below for the result of the security metric and explanation. The result is showing just one security metric right now. Our data source is from Active directory through AD managewise and is fed into splunk. The csv file is coming from external source in excel spreadsheet. The problem is that the excel spreadsheet has about 150 security metrics and my result is only showing just one metric. I need help with splunk query that will go through all the 150 metrics and do the comparison as seen from the above query and give me the result. Please see the result below: Metric ID avg stdev min max latest_count data_item_volatility is_above_thres is_below_thres 1 6145.32 330.95 4854 7319 5934 normal 0 0 max_thres min_thres spreadsheet_data_item_volatility spreadsheet_Metric_Name 7500 5000 Low Total # of GFE hardware assets spreadsheet_Operating_System_Metric_Calculation 5855

ngwodo · ‎12-31-2020

Please I need help with my splunk query below. My query below is only showing just one security metric based on my comparison. I have about 160 security metrics total but only seeing just one. Please I need your help with a splunk query that will show all the 160 security metrics based on my comparison below: index=security source=base_ad_metric_test_v3 earliest=-1y base_ad_metric>0 | stats avg(base_ad_metric) AS avg stdev(base_ad_metric) AS stdev min(base_ad_metric) AS min max(base_ad_metric) AS max latest(base_ad_metric) AS latest_count BY Metric_ID | eval min_thres=5000, max_thres=7500 | eval is_above_thres=if(latest_count>max_thres, 1, 0) | eval is_below_thres=if(latest_count<min_thres, 1, 0) | eval data_item_volatility=case(is_above_thres==1, "High", is_below_thres==1, "Low", true(), "normal") | lookup free_metrics.csv Metric_ID output Data_Item_volatility AS spreadsheet_Data_Item_volatility Operating_System_Metric_Calculation AS spreadsheet_Operating_System_Metric_Calculation Metric_Name AS spreadsheet_Metric_Name

ngwodo · ‎12-30-2020

The Splunk query did not run. I am just giving you an update.

ngwodo · ‎12-29-2020

The splunk query below is only showing just one line of Metric_ID which starts at 1. I need help with the splunk query that we show all the 68 lines of Metric_ID starting from 1. index=security sourcetype="Computers" "Computer Status"=Enabled | bin _time span=1day | dedup _time sAMAccountName | timechart span=1day count |search count > 0 | stats avg(count) AS avg stdev(count) AS stdev min(count) AS min max(count) AS max latest(count) AS latest_count | eval min_thres=5000, max_thres=7500 | eval alert=if((latest_count<min_thres OR latest_count>max_thres), 1, 0) | eval Metric_ID="1" | lookup free_metrics.csv Metric_ID output Data_Item_volatility, Metric_ID, Metric_Name

ngwodo · ‎12-28-2020

Thanks. That was part of the answer. The splunk query I was looking for is: index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon | timechart span=1day count | timechart span=1month earliest(count) AS count | stats avg(count) max(count) min(count)

ngwodo · ‎12-28-2020

I need help on how I can compare 1 day security metric to another day and also generate a metric report that shows low and high and compare it to the security metric in the spreadsheet. Below is the splunk query I have: index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon | bin _time span=1day | dedup _time sAMAccountName | timechart span=1day count | stats avg(count) AS avg stdev(count) AS stdev min(count) AS min max(count) AS max latest(count) AS latest_count | eval min_thres=5000, max_thres=7500 | eval alert=if((latest_count<min_thres OR latest_count>max_thres), 1, 0)

ngwodo · ‎12-23-2020

I need help on how to create splunk rule query to determine when volatility rate changes from low to high and to be able to be alerted. I have a splunk query below on the parameters/threshold that are used to determine metric "Volatility" Here it is: index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon | timechart span=1day count | timechart span=1month earliest(count) AS count | stats avg(count) max(count) min(count)

ngwodo · ‎12-02-2020

Thanks. I had already figure it out. Thanks again for your help.

Posts	59
Solutions	0
Karma Given	6
Karma Received	8
Member Since	‎09-15-2020

Online Status	Offline
Date Last Visited	‎03-09-2023 12:42 AM

How to display details in a single row for a dashb...

Data Model Authentication sucessful splunk query a...

Mitre Dashboard

Authentication Data model duplication of logs issu...

The issue is that we have so many windows authenti...

Duplication of logs between sourcetype:good-audit ...

I am setting up Authentication datamodel that have...

Detailed step-by-step processes to deploy Splunk A...

How can I get Ansible script to automate installat...

Splunk query to pull up all my 160 security metric...

Re: How to display details in a single row for a d...

How to display details in a single row for a dashb...

Data Model Authentication sucessful splunk query a...

Mitre Dashboard

Authentication Data model duplication of logs issu...

Re: The issue is that we have so many windows auth...

Re: The issue is that we have so many windows auth...

The issue is that we have so many windows authenti...

Duplication of logs between sourcetype:good-audit ...

Re: I am setting up Authentication datamodel that ...

I am setting up Authentication datamodel that have...

Detailed step-by-step processes to deploy Splunk A...

Re: How can I get Ansible script to automate insta...

Re: How can I get Ansible script to automate insta...

How can I get Ansible script to automate installat...

Splunk query to pull up all my 160 security metric...

Re: Splunk query to pull up all my 150 security me...

Re: Splunk query to pull up all my 150 security me...

Splunk query to pull up all my 150 security metric...

Re: How I can compare 1 day security metric to ano...

Splunk query to show my entire security metrics wh...

Re: How to create splunk rule query to determine ...

How I can compare 1 day security metric to another...

How to create splunk rule query to determine when...

Re: How to count filled and blank cells in excel s...