About new2spl_unk

new2spl_unk · ‎03-08-2021

Really appreciated with your reply. But this query will miss some device that exist on the inventory list but never sent log to Splunk, I would like to mark the status on the inventory list rather than the metadata list.

new2spl_unk · ‎03-08-2021

Thanks for your reply and by using the query I am able to locate the device that have log within the past 30days. But additionally, I need to compare it with a CSV and then produce a new CSV with status, which means, I need to produce a list like below, by comparing the metadata table and the inventory CSV. Hostname IP status ---------------------------- deviceA 1.1.1.1 "Receiving log" deviceB 2.2.2.2 "No log can be found from past 30days"

new2spl_unk · ‎03-03-2021

Thanks for your reply. But I did select All Time in time range to check if the device on the inventory list have within the last 30 days, but turn out that some device did have log in the past 30days, but the status shown "No log". Can you suggest me how to write a query for checking those device on list have log or not in the past 30 days?

new2spl_unk · ‎03-03-2021

Dear all, Current situation is I uploaded a inventory table to Splunk and the table is like below. Hostname IP ------------------ hostname1 6.6.6.6 hostname2 7.7.7.7 And I would like to check the log collection status (eg. Is the device sending log to splunk, what is the last log time) for the device on the list and produce a list like below. Hostname IP Status Last_log_time ------------------ hostname1 6.6.6.6 Yes 2021-03-03 00:00:00 hostname2 7.7.7.7 No N/A I tried to use "|metadata" but seems like the metadata is not accurate and may I have some idea of how to do this task?

new2spl_unk · ‎01-20-2021

Thanks for your response. I picked 1 of the IOC in the list and tried to search on Threat Artifacts which can be found. But both threat_group and threat_category is undefined. May I know if it will cause any problem?

new2spl_unk · ‎01-14-2021

Thanks for your response. Can you explain more on the "Indexing Audit dashboard" like how it counts the event count exactly. As it count on sample of event then the count should lower than |tstats count? Then why my "Indexing Audit dashboard" always 4-5 times higher than |tstats count ?

new2spl_unk · ‎01-14-2021

Assume the time window is same. But from my environment, the count from indexing audit dashboard is always 4-5 times more than the result from |tstats. If I want to know the Event per day. Which method is more accurate?

new2spl_unk · ‎01-14-2021

Hi all, Why the count of "Event per day" in the "Indexing audit" dashboard is not match with |tstats result? Eg. The number from "Event per day" in the "Indexing audit" dashboard: index count main 10000 The number from |tstats count where index=main by index: index count main 500 May I know which one is correct?

new2spl_unk · ‎01-14-2021

Is that mean if I can search that IOC on Threat Artifacts no matter the threat_group and threat_category is undefined or not, the rules is fine?

new2spl_unk · ‎01-12-2021

Hi All, Recently, I installed MISP42Splunk in my environment in order to integrate MISP with Splunk. Below is the workflow on how I tried to do this. 1. Pull IOC from MISP and outputlookup to a csv. 2. Use SPL to format the CSV 3. outputlookup to xxx_intel like ip_intel, email_intel. But seems like the "threat - gen" search didn't use the updated IOC. May I know if I am doing anything wrong? and how to do it correctly. Thanks.

Posts	11
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎01-12-2021

Online Status	Offline
Date Last Visited	‎03-12-2021 12:36 AM

Inventory status monitoring

tstats not match with metrics.log

Threat intelligence feeds update

Re: Inventory status monitoring

Re: Inventory status monitoring

Re: Inventory status monitoring

Inventory status monitoring

Re: Threat intelligence feeds update

Re: tstats not match with metrics.log

Re: tstats not match with metrics.log

tstats not match with metrics.log

Re: Threat intelligence feeds update

Threat intelligence feeds update