Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About djacquens
djacquens
Path Finder
Member since:
09-19-2021
08-11-2022
Community Statistics
| Posts | 13 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 09-19-2021 |
Activity Feed
- Posted Re: How do I add a Role Restriction Search Filter on a field available in only one index? on Splunk Search. 07-28-2022 01:27 AM
- Posted Re: How do I add a Role Restriction Search Filter on a field available in only one index? on Splunk Search. 07-27-2022 11:42 PM
- Posted Re: Lock for Playbooks on Splunk SOAR (f.k.a. Phantom). 07-27-2022 09:24 AM
- Posted How do I add a Role Restriction Search Filter on a field available in only one index? on Splunk Search. 07-27-2022 09:20 AM
- Posted Re: Lock for Playbooks on Splunk SOAR (f.k.a. Phantom). 07-22-2022 02:01 AM
- Posted Re: Is there any way to get any debug info inside this script? on Splunk SOAR (f.k.a. Phantom). 07-22-2022 01:55 AM
- Karma Re: Search any info on preprocess script for msayar. 07-22-2022 01:54 AM
- Posted Re: Lock for Playbooks on Splunk SOAR (f.k.a. Phantom). 03-22-2022 02:37 AM
- Tagged Re: Lock for Playbooks on Splunk SOAR (f.k.a. Phantom). 03-22-2022 02:37 AM
- Tagged Re: Lock for Playbooks on Splunk SOAR (f.k.a. Phantom). 03-22-2022 02:37 AM
- Tagged Re: Lock for Playbooks on Splunk SOAR (f.k.a. Phantom). 03-22-2022 02:37 AM
- Tagged Re: Lock for Playbooks on Splunk SOAR (f.k.a. Phantom). 03-22-2022 02:37 AM
- Posted Re: Phantom.debug() string won't perform string interpolation. on Splunk Search. 11-05-2021 07:23 AM
- Posted Is there any way to get any debug info inside this script? on Splunk SOAR (f.k.a. Phantom). 10-28-2021 01:12 AM
- Posted Re: Will there be an update for Visual SPL? on Splunk Enterprise. 10-26-2021 09:57 AM
- Karma Re: How to schedule a Phantom playbook to run at specific intervals? for AlexBryant. 10-13-2021 08:51 AM
- Karma Re: How to use an if on Tags ? for PickleRick. 09-23-2021 03:01 AM
- Posted Re: How to use an if on Tags ? on Splunk Search. 09-22-2021 08:33 AM
- Posted Re: How to use an if on Tags ? on Splunk Search. 09-21-2021 05:45 AM
- Posted How to use an if on Tags ? on Splunk Search. 09-19-2021 08:56 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
07-28-2022
01:27 AM
Thank you very much @yuanliu !! Have a great day! 😉 David
... View more
07-27-2022
11:42 PM
Thank you very much @yuanliu ! The SPL you gave me works only for me if I replace the :: by =. (index=that_index AND field_name=field_value) OR index!=that_index I understand this is not recommended but I don't understand how to fix it? Thank you again, David
... View more
07-27-2022
09:24 AM
@phantom_mhike Thanks for the input. We shall try your app in the next few days. Thanks again
... View more
07-27-2022
09:20 AM
Hi, 😉 I need to add a Role Restriction Search filter on a field which is only available in one index. My problem is that I am not sure the proper way to force this restriction on only this index? If I add a restriction like this
"field_name"="field_value"
it works fine for the index containing the value but the others indexes return nothing.
If I add a restriction like this:
((NOT "field_name"=* ) OR ( "field_name"="field_value"))
the result seems false. Do you have an idea of the correct field to restrict this field? Thanks, 😊 Regards, David
... View more
Labels
- Labels:
-
other
07-22-2022
02:01 AM
Thanks for the reply. The same playbook on each artifacts of the Crowdstrike Falcon Apps and virtually at the same time. This does create some issue of concurrency. It is not possible to add a TAG as they run at the same time and add at the same time the TAG.
... View more
07-22-2022
01:55 AM
I had missed your reply. Thank you very much
... View more
03-22-2022
02:37 AM
Hi, We are facing the same issue here. We decided to deal with the issue of different playbooks running at the same time by adding a small random sleep as a Quick Fix but this is ugly. Therefore, I would like to know if you or anybody has ever managed to deal with a lock/semaphore to deal with this issue of having many playbooks running on the same container at the same time? Thanks, David
... View more
11-05-2021
07:23 AM
This is an old question but I believe it is because you forgot the f before the string. It should be: phantom.debug(f"Testing: {foo}") 😉
... View more
10-28-2021
01:12 AM
Hi, We need to use a preprocess script for the Crowdstrike APP but don't manage to have it working.
We are interested about any information on how this works. Is there any way to get any debug info inside this script? Would you have a basic script to start with?
Thanks in advance 😉
David
... View more
Labels
- Labels:
-
development
-
using SOAR ⁄ Phantom
10-26-2021
09:57 AM
Hi, It is written on SPLUNKBase "This app has been archived." Therefore, do not expect any update from Visual SPL, it is probably not safe to use neither. I believe that ES 8.2.2.1 is compatible with Python 3.7. Hope this helps,
... View more
09-22-2021
08:33 AM
OK thank you very much. I used spath: | spath tags{} output=toto
| eval aa = if(mvfind(toto, "tag_searched")>0, "A", "B")
... View more
09-21-2021
05:45 AM
Thank you @PickleRick I tried using mvfind but without any luck. index = "phantom_container" earliest=-1d
| dedup id
| eval foo = if(isnull(mvfind(tags, "xyz")), «A» , «B») I guess I am not using the correct syntax to access the tags field. I have the same issue with the field tenant_id. What am I missing? Thanks in advance, David
... View more
09-19-2021
08:56 AM
Hi, I am new to SPLUNK/SPL and I am wondering how can I check if the Tags field contains a tag "foo" within an eval. Something like: eval toto = if("tags{}" == "foo", 1,2)' Thanks, David
... View more
Labels
- Labels:
-
eval
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-11-2022
09:50 AM
|
