Did you add the proxy options to the intel download settings to see if that remediated it?   Additionally, I have noticed that sometimes the proxy will block the intel downloads as it thinks the list of malicious URLs/domains/IPs is itself malicious. I had to whitelist links coming from my Splunk instance on the proxy to remediate this.  ... View more

Threat retention is based on the source. So assuming you have the latest version of ES the easiest way is to... Navigate to the ES app > click "Configure" > Click" Data Enrichment" > Click "Threat Intelligence Management". Then find the input you want to change with the "Advanced Edit" button. This has a setting of "Maximum age" which is what you would modify to change the retention or the "Interval" to change how frequently (in seconds) the input runs to bring in new or update old indicators.  ... View more

Have you checked out the URL toolbox app? It has some handy macros that allow you to parse domains & TLDs. https://splunkbase.splunk.com/app/2734   If you want to see the top domains (after you remove the subdomains), try a search like the one below. I would look for a field in your web app logs that might indicate if it is malicious or not. Otherwise, you will need to add some kind of threat intelligence list to ES to cross-reference malicious sites with what is found in your logs.   index=netwaf | stats sum(bytes) as total_bytes count by domain ... View more

There are numerous posts on converting timestamps to milliseconds, and formating the _time field (may involve changes to the sourcetype) so the actual syntax/solution will be based on your data set. Here is a good example of converting to milleseconds https://community.splunk.com/t5/Splunk-Search/TimeFormat-conversion-to-millisecond/m-p/212326 If you are looking to search on the _raw field,  adding that to a data model is not advisable. One of its purposes of a data model is to reduce and consolidate the number of fields and size of events to a summary version so adding that field would directly contradict that purpose. I would recommend just using that field for your search or adding additional field extractions to the data and then adding the new fields to the custom DM.  ... View more

You can delete notable event suppressions by going to Settings > eventtypes and searching for the suppression that you want to delete. Here is the link to the Splunk doc on that: https://docs.splunk.com/Documentation/ES/7.0.2/Admin/Customizenotables However for tracking/audit purposes, it is probably better to just disable them.  ... View more

If you are getting duplicate alerts for the same ATP incidents, look into throttling the results based on the same field values. Check out this page for more information. https://docs.splunk.com/Documentation/ES/7.0.2/Tutorials/ScheduleCorrelationSearch#:~:text=Set%20up%20throttling%20to%20limit%20the%20number%20of%20alerts&text=Typically%2C%20you%20only%20want%20one,alerts%20to%201%20per%20day. ... View more