About XOJ

cit_student · ‎09-27-2022

Hi @XOJ Yes, I used Elastic Sources to fix my issue in this case. But thankfully, this issue seems to have been confined to this one app. Other sources behaving as expected.

XOJ · ‎09-01-2022

I have some searches that do not appear to be enhancing properly using the asset_lookup_by_str lookup table. In this case, I'll use dvc, but it appears to be similar with the others like dest as well. I run a search, the enhancements don't seem to be happening. If I run a search using the lookup it works sometimes. I'll give a few examples Search 1: index=windows | lookup asset_lookup_by_str asset AS dvc OUTPUTNEW domain AS AAAAA Result 1: I get AAAAA to have only 1 of our 5 domains Search 2: index=windows host=[hostname] | lookup asset_lookup_by_str asset AS dvc OUTPUTNEW domain AS AAAAA Result 2: AAAAA doesn't show up . Search 3: | inputlookup asset_lookup_by_str Result 3: The lookup table appears to be filled in nicely. Including the domains missing from search 1. Search 4: | inputlookup asset_lookup_by_str | search asset=[host] Result 4: The host searched in Search 2 is in the lookup table. Based on this, I'd say not only should Search 2 have worked, but Search 1 should have had more results, and the automatic lookup as a whole should be working. Any ideas what could be happening? My only thought is maybe some sort of priority order that is overriding the enhancement feature. But that wouldn't explain it not working in the specific search.

XOJ · ‎05-25-2022

In case someone else looks at this, if you manually want to place the file: If you are manually going to download the update, you will grab the raw JSON from https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json Move this to the ES Search Head and place it in $SPLUNK_HOME/var/lib/splunk/modinputs/threatlist/ You will need to save this as mitre_attack for the file name. The mitre_attack file will contain this raw JSON that you downloaded. You should then just be able to run the Threat - Mitre Attack - Lookup Gen saved search and the output in the KV store will be properly populated.

XOJ · ‎05-11-2022

I have a sourcetype the provides results for dst if it has one result or dst{} with multiple results. I am attempting to get this into a data model to be used; however I can't get dst{} to work. dst=dest works just fine, but dst{}=dest does not work. When doing dst{}= (IP address), the search works just fine. So I know it doesn't have an issue finding the information. I am missing something for what is needed to make it work within a data model. After researching for a couple days and failing, I thought I'd ask the community for their knowledge.

XOJ · ‎05-11-2022

I got the below to work: s-sitename\s(?<s_sitename>\w+?)\ss-computername\s(?<s_computername>.*)\ss-ip\s(?<s_ip>.*?)\scs-method\s(?<cs_method>\w+?)\scs-uri-stem\s(?<cs_uri_stem>.*?)\scs-uri-query\s(?<cs_uri_query>.*?)\ss-port\s(?<s_port>.*?)\scs-username\s(?<cs_username>.*?)\sc-ip\s(?<c_ip>.*?)\scs-version\s(?<cs_version>.*?)\scs$User-Agent$\s(?<cs_User_Agent>.*?)\scs$Cookie$\s(?<cs_Cookie>.*?)\scs$Referer$\s(?<cs_Referer>.*?)\scs-host\s(?<cs_host>.*?)\ssc-status\s(?<sc_status>.*?)\ssc-substatus\s(?<sc_substatus>.*?)\ssc-win32-status\s(?<sc_win32_status>.*?)\ssc-bytes\s(?<sc_bytes>.*?)\scs-bytes\s(?<cs_bytes>.*?)\stime\-taken\s(?<time_taken>\d+?)\s(?<additional_info_1>.*)\s?(?:x-forwarded-for|X-Forwarded-For)\s(?<x_forwarded_for>(?:\d+\.\d+\.\d+\.\d+|\-))\s?(?<additional_info_2>.*)?

XOJ · ‎05-11-2022

What you said was correct. New data does come in with the new level. Splunk support really gave little assistance in how to speed up the rebuild. Adding more concurrent searches with acceleration.max_concurrent may speed it up. And changing the backlog with acceleration.backfill_time may make it less painful by doing partial fill ins. I ended up not rebuilding the larger data models just due to the length of time it would take. I believe when the new data is at the max amount of time saved in the data model they will be at the new level.

scelikok · ‎08-26-2021

Hi @XOJ, dump command may help you to export a large amount of data. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dump Below will create daily dump files index=yourindex | eval _dstpath=strftime(_time, "%Y%m%d") | dump basefilename=search1

XOJ · ‎08-06-2021

It requires setting up additional servers, but for most of our Windows events, we use Windows Event Collectors. https://docs.microsoft.com/en-us/windows/win32/wec/windows-event-collector Have the data sent to the WEC via subscription, the use a UF on the WEC to send it to Splunk. We had to use this because the Windows Team didn't want additional software on their endpoints.

Posts	15
Solutions	0
Karma Given	6
Karma Received	3
Member Since	‎08-06-2021

Online Status	Offline
Date Last Visited	‎09-30-2022 12:07 AM

Why is my auto lookup not working as intended?

How to use dst{} in data model?

How to extract fields out of the winevent IIS logs...

How do I export large amounts of data?

Re: TrackMe App - data_last_time_seen field not up...

Why is my auto lookup not working as intended?

Re: Need help please. Threat list for MITRE ATT&CK...

How to use dst{} in data model?

Re: Assistance with Extraction

Re: tsidxWritingLevel and datamodel

Re: How do I export large amounts of data?

Re: collect log from windows server without univer...