Hi Team,   I have a field name domain with value "www.microsoft.com"; how I can reverse that and make it to "com.microsoft.www"   domain=www.microsoft.com required: domain=com.microsoft.www   Many Thanks. ... View more

Hi Team,   I want support to know why I am not able to see lookup for my created Threat Intelligence Management Source under Splunk Enterprise Security pulled from Github. I am trying to get mac and its vendor details as intelligence after using the feature of "Threat Intelligence Management"   My configurations are below:   1. Creation of source under Threat Intelligence Manager with "Line Oriented" selection. 2. Input name mac_vendor with description as mac_vendor, type also mac_vendor with Github URL details:  3. Unchecked "Threat Intelligence" Box. 4. File Parser Auto 5. Delimiting regular expression setting as : , 6. Ignoring regular expression setting as : (^#|^\s*$) 7. field section: mac:$1,vendor:$2 8. skip header lines : 0 with rest configured as default only. Sample Event showing successful file download: INFO pid=28775 tid=MainThread file=threatlist.py:download_threatlist_file:549 | stanza="mac_ioc" retries_remaining="3" status="threat list downloaded" file="/opt/splunk/var/lib/splunk/modinputs/threatlist/mac_ioc" bytes="678565" url="https://gist.githubusercontent.com/aallan/b4bb86db86079509e6159810ae9bd3e4/raw/846ae1b646ab0f4d646af9115e47365f4118e5f6/mac-vendor.txt" What I am missing to see this information in Splunk S.A Intelligence? ... View more

Hi Team,   I have a requirement to integrate Phantom with SNOW. Now the challenge is in SNOW I require some extra fields to be populated example: Incident Category field should be always Crime and Assignment Group should be always a particular team Service Now queue name. By using the current App in Splunk Phantom I dont know how to set my required fields.  Kindly suggest. ... View more

Hi Community, I need support to know how I can get the non-existent values from the two fields obtained from the "appendcols" command output. Example of Splunk output in table format below: 1st_Field  2nd_Field 1111          2222 empty        3333 empty         1111 I am able to get 1111 after using the lookup command but I want to get 2222 and 3333 only as those are not present in 1st Field. ... View more

Hi Team, Can we monitor the lookup files i.e from updates prospective who updates what in a lookup file or even in a KV store. This is one of the requirements of monitoring so that if tomorrow something needed; we can backtrack and able to answer who; what and when. Thanks in advance. ... View more

Hi Community Members, Anyone knows whether we can use Splunk Enterprise Security to map our correlation searches against MITRE Tactics and Techniques without installing more apps like MITRE Dashboard or Splunk Security Essentials. This mapping can help to see what security coverages we have and what requires improvements.   Many Thanks in advance. ... View more

I would like to know when I will install MITRE app in Enterprise Security then it will automatically populate the dashboard or I need to adjust my use case naming conventions too? For Example Right now Use Cases are not mapped as per MITRE Techniques.   Example currently use case name is : "Failed Logon Accounts" but to use MITRE app for Splunk; do I need to modify the use case name to "T1110-Failed Logon Accounts"? ... View more

Hi Splunk Community, Sorry if my question is basic but I am new to ML usage in Splunk. I saw an inbuilt example of Splunk ML model which is to predict the presence of malware. So my idea was to use the the same model which contains email data with status of "malicious" or "not".  I used around 2000 malicious emails and 2500 thousand non malicious emails. When I am using that CSV file in Predict Categorical Fields using any ML model like logistic-categorical or random-forest I am getting error of "No valid fields to fit or apply mode to. Here I am trying to predict the status field. SPL Query: | inputlookup email_data.csv | head 5000| fit LogisticRegression fit_intercept=true "status" from "fromAddress" "messageid" "senderIP" "senderdomain" "subject" into "example_malware" Any help of if anyone implemented this and can suggest me with example would be really helpful. ... View more

Hi Splunk Members, Good Day! I am looking for support to create a query with Windows Security Events Logs. Basically the idea is to search for different Windows Security Event IDs events within a short span by Account Name. Example: To return events if events id: XXXX occurs at 1 PM EST then within 1 min i.e 1:01 PM; Event ID: YYYY occurs and then event id: ZZZZ also occurs for same Account_Name then my query should results all those events. Kindly note, condition should met if all three event ids trigger within short span that is 1 min here. If for an example Event ID XXXX occurs but Event IDs YYYY and ZZZZ do not for the same Account Name then results should be zero in the ouput. Many Thanks.         ... View more