About parkz

parkz · ‎11-21-2022

My organization is struggling to successfully incorporate data science into existing security processes successfully. I'm having a hard time finding resources that help me assess the maturity level of data science in my environment and how to mature it further with possible use cases and strategies to focus on. Does anyone know if there's any resources out there to help my organization head in the right direction?

parkz · ‎04-01-2022

I'm trying to run the following commands on an index: | eval elast=strptime(lastSeen,"%Y-%m-%d %H:%M:%S") | eval daysSinceLastSeen = round((now() - elast)/86400, 1) ```Calculate days elapsed since lastSeen``` | eval active_status = if ((latest (daysSinceLastSeen) <= 28), "active", "inactive") There is an error that keeps popping up stating 'latest' function is unsupported or undefined. How do I correct that?

parkz · ‎04-01-2022

Hello, I have a field I created called daysSinceLastSeen that shows the days since an asset was last seen in a scan. I now want to create a histogram to show the distribution of that data by days. How do I do that in spl? In case you need my search, it is as follows: | eval elast=strptime(lastSeen,"%Y-%m-%d %H:%M:%S") | eval daysSinceLastSeen = round((now() - elast)/86400, 1) ```Calculate days elapsed since lastSeen``` | table _time, status, asset_id, scanID, lastSeen, daysSinceLastSeen, last*, firstSeen, ipaddress, source, host | sort - _time

parkz · ‎03-15-2022

I have a lookup of all active credentials from tenable called tio_credentials.csv. I have a search that lists unique credentials used, like so: `tenable` `io` earliest=-15d pluginID=19506 | rex field=plugin_output "'(?<domain>.*\\\)?(?P<Credentialed_Checks>.*)'" | stats dc(host-ip) as count by Credentialed_Checks How do I compare the list of credentials from Splunk events with the lookup in a way that shows all the credentials in the lookup that aren't showing up in events? I'm new to splunk and trying to see if there's any credentials we can remove from our credentials list.

parkz · ‎05-27-2021

Is there a similar file path for Linux Splunk app?

parkz · ‎05-27-2021

I have the following search: earliest=-1d@d latest=@d index=cdb_summary sourcetype=cfg_summary source=CDM_*_Daily_Summary | search hva=* | eval FailedSTIGs=mvsort(split(FailedSTIGs,",")) | stats values(fismaid) as fismaid dc(asset_id) as Affected by FailedSTIGs,hva | lookup DHS_Expected_Checks "STIG ID" as FailedSTIGs output "Rule Title" | fit TFIDF "Rule Title" as rule_tfidf ngram_range=1-12 max_df=0.8 min_df=0.2 stop_words=english | fit KMeans rule_tfidf* k=8 |stats values(FailedSTIGs), values("Rule Title") by cluster How can I add stop words to the stop_words argument? In python I would write the following: from sklearn.feature_extraction import text stop_words = text.ENGLISH_STOP_WORDS.union(my_additional_stop_words) Obviously I can't use python, but I am not familiar enough with Splunk searches to know if it's possible to modify the english keyword in a similar way so that it takes in additional words like "Windows"

parkz · ‎05-26-2021

I have a field of titles that are filled with sentences about why a test was failed in a security audit, but they are separated by each asset. So there can be two different assets with the same reason listed but in different words. For example, one might say "Login Password is empty" and another asset failure will say "Login password did not meet requirements". If I could aggregate them based on words like "password", I can get more value from the data. I can't hardcode it because I don't know all the possible aggregates. Here is what I have so far, and I'm open to any feedback: earliest=-1d@d latest=@d index=cdb_summary sourcetype=cfg_summary source=CDM_*_Daily_Summary | search hva=* | eval FailedSTIGs=mvsort(split(FailedSTIGs,",")) | stats values(fismaid) as fismaid dc(asset_id) as Affected by FailedSTIGs,hva | lookup DHS_Expected_Checks "STIG ID" as FailedSTIGs output "Rule Title" | fit TFIDF "Rule Title" as rule_tfidf ngram_range=1-12 max_df=0.6 min_df=0.2 stop_words=english | fit KMeans rule_tfidf* k=8 | fields cluster "Rule Title" | sample 6 by cluster | sort by cluster

Posts	7
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎05-26-2021

Online Status	Offline
Date Last Visited	‎11-22-2022 07:21 AM

Are there any resources available for Data Science...

Why is my search returning error?

How to create histogram of a single field?

Compare list of used credentials in events with li...

Add stopwords to tfidf command in splunk

How to filter a field by common words