About ravida

ravida · ‎05-23-2024

It happens for all of them. The strange part is, when i first click, you can see the notable name in the URL after "/incident_review?form.rule_name=(rule name)" followed by earliest/latest timestamos but after a moment it disappears and is replaced with a new URL which only has the earliest/latest values

ravida · ‎05-23-2024

They are blank. I was under the impression these are for showing the contributing events. Although I am trying to get the "Incident Review" to only show those notables in the list, instead of all notables.

ravida · ‎05-22-2024

They are blank. I was under the impression these are for showing the contributing events. Although I am trying to get the "Incident Review" to only show those notables in the list, instead of all notables.

ravida · ‎05-20-2024

Hi folks, This has been bugging me for a while. When I click on a custom-made correlation search in the Security Posture's Top Notable Events dashboard pane, it doesn't filter for that rule name in the incident review, it just shows all of them. Where do I configure it to drill down properly? Thanks!

ravida · ‎06-20-2023

Hi folks, I created a correlation search that looks for administrators setting passwords to never expire, which then creates a notable event for incident review. I tried setting the severity to both "high" and "critical", but when the notable is created the urgency field shows up only as "informational". When I test the rule, I did it against on accounts that show up as both "high" and "critical" priority in the Identity Investigator, data I enrich via Active Directory. I checked the lookup table for urgency_lookup and it is as you would expect, nothing is different than the default that would make it calculate to informational. What may I be missing? Thanks!

ravida · ‎02-02-2023

Is there a way to find out what the oldest events are, by index, in the local cache when running SmartStore? I am able to ssh in and look at the local buckets, but is there a way to see it in the monitoring console or by query? Thanks! Joe

ravida · ‎01-20-2023

Hi folks, I have a realtime search that looks at failed windows logins, producing a "single value" timechart visualization with a sparkline and trend value next to it. index=windows EventCode=4625 | timechart span=1h count Instead of having it snap to the hour, I would like it to show the values without snapping, effectively grouping by the current minute - 60m for each. Is there a way to group that in real time searches?

ravida · ‎08-11-2022

Hi folks, I have recently been testing out how to ensure the connection between my deployment server and the universal forwarders is secure. I followed the instructions and deployed a new app with some stanzas to a test windows workstation server class, via deploymentclient.conf to conform to this: [deployment-client] sslVerifyServerCert=true caCertFile=$SPLUNK_HOME/etc/apps/<this apps name>/auth/ca.pem sslCommonNameToCheck = <common name in DS cert> My question is how can I confirm it is connecting securely? Most of the documentation I find describes securing the indexers to forwarders, but not the deployment server to client/forwarder connection.

Posts	8
Solutions	0
Karma Given	4
Karma Received	1
Member Since	‎05-26-2021

Online Status	Offline
Date Last Visited	‎07-26-2024 04:25 PM

Clicking on a custom rule's name in ES Top Notable...

Enterprise Security incident urgency showing "info...

Is there a way to find out what the oldest events ...

Realtime search with a sliding window that doesn't...

How to verify a secure connection between the depl...

Re: Clicking on a custom rule's name in ES Top Not...

Re: Clicking on a custom rule's name in ES Top Not...

Re: Clicking on a custom rule's name in ES Top Not...

Clicking on a custom rule's name in ES Top Notable...

Enterprise Security incident urgency showing "info...

Is there a way to find out what the oldest events ...

Realtime search with a sliding window that doesn't...

How to verify a secure connection between the depl...