Hello Are there any internal logs in Splunk that show changes made to the query, who made it and what change he made? ... View more

Hey all When Im creating a new scheduled search for customer .. there is any option to save the trigged alert to specific index or another place ? I don't want that the customer will see the rules as fired and the notable triggered alert. I just want to check the rule as staging .. and get the triggered alert to another place that is not notable index or something that the customer can check. there is any solution that is not by sending  mail? ... View more

Hi There is any option to get a list of acceleration data model and what rules / reports / queries) using each of the acceleration  datamodels ?  (need that in API query) thanks! ... View more

Hi Need you help with API query for getting accelerated datamodels statistics (usage and size) thanks! ... View more

Hello I have this Splunk built In rule: "  Brute Force Access Behavior Detected Over 1d"     | tstats `summariesonly` values(Authentication.app) as app,count from datamodel=Authentication.Authentication where earliest=-1d by Authentication.action,Authentication.src,index | `drop_dm_object_name(\"Authentication\")` | eval success=if(action=\"success\",count,0),failure=if(action=\"failure\",count,0) | stats values(app) as app,sum(failure) as failure,sum(success) as success by src,index | where success > 0 | `mltk_apply_upper(\"app:failures_by_src_count_1d\", \"medium\", \"failure\")` | rex field=index \"(?<bu_prefix>[a-zA-Z]+)\" | lookup org_lookup.csv bu_prefix OUTPUTNEW Organization"   1. How can I add to this query indication of which user was used? 2. The query shows app list + number of failures + number of successes, but no correlation of failures/successes to apps, how can I do that? 3. How can I add to the query failure reason? 4. If there is IP address only made several failed login attempts to one user. How can we catch such a scenario?   Thanks! ... View more

Hello I have this query:   "| tstats `summariesonly` values(Authentication.app) as app,count from datamodel=Authentication.Authentication where earliest=-1d by Authentication.action,Authentication.src,index | `drop_dm_object_name(\"Authentication\")` | eval success=if(action=\"success\",count,0),failure=if(action=\"failure\",count,0) | stats values(app) as app,sum(failure) as failure,sum(success) as success by src,index | where success > 0 | `mltk_apply_upper(\"app:failures_by_src_count_1d\", \"medium\", \"failure\")` | table userPrincipalName, state"     1. I need to add user to the query but I didnt find user field on this datamodel  (used this stats dc() as * | transpose) How can I find all the fields there ?  2. Also, shows app list + number of failures + number of successes, but but no correlation of failures/successes to apps, how can I add this?   3. How can I add failure reason ?   thanks! ... View more

    Hello Im trying to run this query from Splunk API and getting this error: 'rex' is not recognized as an internal or external command, operable program or batch file.   Can you help me please?   "index=wineventlog sourcetype=\"WinEventLog:Security\" (EventCode=4698 OR EventCode=4702) *ADDC*\n| where LIKE(Account_Name,\"%$\")\n| eval operation=(if(EventCode==4698,\"new\",\"update\"))\n| rex field=Message \"<Command>(?<Command>[^\\;]+)</Command>\"\n| rex field=Message \"<Arguments>(?<Arguments>[^\\;]+)</Arguments>\"\n| rex field=Message \"<UserId>(?<UserId>[^\\;]+)</UserId>\"\n| where !LIKE(Command,\"%sc.exe\")\n| where !LIKE(Command,\"%usoclient.exe\")\n| where !LIKE(Command,\"%ceipdata.exe\")\n| where !LIKE(Command,\"%OfficeC2RClient.exe\")\n| where !LIKE(Command,\"%rundll32.exe\")\n| where !LIKE(Command,\"%wermgr.exe\")\n| where !LIKE(Command,\"%MusNotification.exe\")\n| where !LIKE(Command,\"%MpCmdRun.exe\")\n| where !LIKE(Command,\"%SymErr.exe\")\n| eval user=case(UserId==\"S-1-5-18\",\"Local System\",UserId==\"S-1-5-19\",\"Local Service\",UserId==\"S-1-5-20\",\"Network Service\",true(),UserId)\n| stats values(Task_Name) as taskname values(operation) as event by _time Account_Name Command Arguments user\n| sort - _time"     ... View more

Hi All  I have this query index=checkpoint sourcetype=opsec:anti_virus OR sourcetype=opsec:anti_malware Protection_Name=* NOT action=blocked NOT te_action=block | stats count dc(Protection_Name),values(Protection_Type),values(Destination_DNS_Hostname),values(te_action),values(malware_action),values(file_name),values(file_md5),values(dest),values(Protection_Name) by src | `map_notable_fields` | rename values(Protection_Type) as \"Protection_Type\",values(Destination_DNS_Hostname) as \"Name_Resolved\",values(te_action) as Action,values(malware_action) as \"Malicious_Intent\",values(file_name) as \"File_Name\",values(file_md5) as \"File_Hash\",values(dest) as Dest,src as Source,values(Protection_Name) as \"Protection_Names\",dc(Protection_Name) as \"Infection_Count\"| where Infection_Count>1 | table \"Infection_Count\",Source,\"Protection_Names\",\"Protection_Type\",Dest,\"Name_Resolved\",\"File_Name\",\"File_Hash\",\"Malicious_Intent\",Action"   how can i know how much notable events i will get historical by hour?  I mean not a query over the last 2 hours, but a query every 2 hours for the last month. In other words, if they run the rule every 2 hours, how many notables per day should they expect?   I tried to do that but its not working: |gentimes start=-20 end=0 increment=1d | map maxsearches=90 index=checkpoint sourcetype=opsec:anti_virus OR sourcetype=opsec:anti_malware Protection_Name=* NOT action=blocked NOT te_action=block | stats count dc(Protection_Name),values(Protection_Type),values(Destination_DNS_Hostname),values(te_action),values(malware_action),values(file_name),values(file_md5),values(dest),values(Protection_Name) by src | `map_notable_fields` | rename values(Protection_Type) as \"Protection_Type\",values(Destination_DNS_Hostname) as \"Name_Resolved\",values(te_action) as Action,values(malware_action) as \"Malicious_Intent\",values(file_name) as \"File_Name\",values(file_md5) as \"File_Hash\",values(dest) as Dest,src as Source,values(Protection_Name) as \"Protection_Names\",dc(Protection_Name) as \"Infection_Count\"| where Infection_Count>1 | table \"Infection_Count\",Source,\"Protection_Names\",\"Protection_Type\",Dest,\"Name_Resolved\",\"File_Name\",\"File_Hash\",\"Malicious_Intent\",Action   What can I do?   Thanks ... View more

Hi Need you help please with a query; "| tstats summariesonly=true allow_old_summaries=true dc(Malware_Attacks.date) as \"day_count\",count from datamodel=Malware.Malware_Attacks by \"Malware_Attacks.dest\",\"Malware_Attacks.signature\" | rename \"Malware_Attacks.dest\" as \"dest\",\"Malware_Attacks.signature\" as \"signature\" | search dest=\"10.0.0.0/8\" OR dest=\"192.168.0.0/15\" OR dest=\"172.16.0.0/12\"\n| where 'day_count'>3"   I got an errors:  "type": "ERROR", "text": "[idx-indexname.splunkcloud.com] The search process with search_id=\"remote_sh-i-idx-indexname.splunkcloud.com_1\" may have returned partial results. Try running your search again. If you see this error repeatedly, review search.log for details or contact your Splunk administrator."   How can I fix that? thanks ... View more

Hi My query taking too long.. and its    | from datamodel:Intrusion_Detection.IDS_Attacks | where _time>relative_time(now(),"-10s@s") | stats values(tag) as tag,dc(signature) as count by src | where count>25   And it seems it will never return output any idea? ... View more

Hi when i ran this query:     "| tstats count, values(\"Authentication.tag\") as tag from datamodel=Authentication where ((nodename = Authentication.Failed_Authentication) \`hdsi_repeat_failed_logins_alert_filter\`) groupby \"Authentication.src\", \"Authentication.dest\", \"Authentication.user\", _time span=1s | \`drop_dm_object_name(\"Authentication\")\` | eventstats sum(count) as src_count by src | eval user=lower(mvindex(split(user,\"@\"),0)) | search NOT [ search earliest=-24h@h tag=modify tag=password user=* NOT user=\"*$\" | eval user=lower(mvindex(split(user,\"@\"),0)) | dedup user | fields user ] | lookup hdsi_user_login_statistics.csv src, dest, user | eval p_fail_user = exact(failcountbyuser / totalcountbyuser) | eval p_fail_src=exact(failcountbysrc / totalcountbysrc) | where (p_fail_user < 1 AND ( p_fail_src > 0.05 OR p_fail_user > 0.1)) OR isnull(p_fail_user) | eval safeness=case(tag==\"privileged\", 0.25, tag==\"mail\", 6, tag==\"disabled_or_locked_out_authentication\", 8, tag==\"known_scanner_src\",20) | fillnull value=1 safeness | transaction maxspan=10m src,dest,user | stats values(dest) as dest, values(user) as user, sum(count) as eventcount, min(_time) as _time, max(duration) as duration, sum(safeness) as safeness, dc(dest) as dest_count by src | eval thresh = (safeness*30)/dest_count | where eventcount > thresh" Im getting this error: "type": "INFO", "text": "The limit has been reached for log messages in info.csv. 25 messages have not been written to info.csv. Refer to search.log for these messages or limits.conf to configure this limit." someone can help with that please ? ... View more

Hi This is my API AWS query: "search index=aws userIdentity.type=Root eventName=ConsoleLogin earliest=-10d  | rex field=_raw MFAUsed\D\D\s\D(?P<Mfa>\D?\S) | rex field=_raw principalId\D:\s\D(?P<principalId>\d*)" | stats count by principalId" its working and im getting results. Now I need your help with add the field that I parse (Mfa) and to add Mfa="No" to the query but its not showing resutls. I tried to do something like that: "search index="aws" (userIdentity.type="Root" eventName="ConsoleLogin" Mfa="No*" earliest=-10d | rex field=_raw MFAUsed\D\D\s\D(?P<Mfa>\D?\S) | rex field=_raw principalId\D:\s\D(?P<principalId>\d*)" What Im missing? Thanks! ... View more

HI all, I have this rule: "Unapproved Port Activity Detected" - I know this rule creates many alerts, how can i find the daily count of this specific event? and what is trigger?   ... View more