×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
schimpy
New Member
Member since: ‎10-07-2021
‎11-22-2021
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎10-07-2021
View All

Re: Mandiant Advantage

by in All Apps and Add-ons
‎11-21-2021 11:45 PM
‎11-21-2021 11:45 PM
Hello @andy_splunk_2 , Does the enabling produced a lot of notable events? I am a bit scared not to overwhelm our SOC... ... View more

Re: Mandiant Advantage

by in All Apps and Add-ons
‎11-18-2021 06:42 AM
‎11-18-2021 06:42 AM
Hello @andy_splunk_2  I am having the same "issue" here. I managed to set up ingestion of Mandiant-based IoC to defined index. Although I set up correlation with my netflow data model (Setup > Config > Mandiant Advantage Correlation Settings), I have no signs it is working somehow. Have you made any progress here? Br, Simon ... View more

Splunk MISP42 sighting: How to update the sighting...

by in All Apps and Add-ons
‎10-07-2021 01:57 AM
‎10-07-2021 01:57 AM
Hello folks, Has anyone of you made it work that you somehow update the sighting of an attribute in connected MISP instance? I have my MISP integrated to Splunk, IoC are being downloaded to TI framework. Based on this some correlation searches that are scheduled, TI-based notables triggers I am looking for a way how to get the feedback about TP/FP back to MISP. I am using MISP42Splunk app, which has an adaptive response action "Alert for sighting MISP attribute(s)"  but I cannot make it work. I was also trying to do it via some in-build MISP command without any success. Do you guy have implemented this feature of do you know some way to do it? Thanks! ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎11-22-2021 03:05 AM