Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About LIP
LIP
Loves-to-Learn
Member since:
10-19-2021
10-23-2022
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 10-19-2021 |
Activity Feed
- Posted Splunk ES Drill-Down- How do I receive 2 separate notable alerts? on Splunk Enterprise Security. 10-23-2022 04:27 AM
- Posted Re: How can we track when Correlation searches were created on Splunk Enterprise Security. 06-27-2022 02:12 AM
- Posted Re: How can we track when Correlation searches were created on Splunk Enterprise Security. 06-27-2022 12:30 AM
- Posted Re: How can we track when Correlation searches were created on Splunk Enterprise Security. 06-26-2022 11:31 PM
- Posted Re: How can we track when Correlation searches were created on Splunk Enterprise Security. 06-21-2022 07:05 AM
- Posted How can we track when Correlation searches were created on Splunk Enterprise Security. 06-21-2022 12:34 AM
- Posted Correlation alert with multiple events on Splunk Search. 10-19-2021 09:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
10-23-2022
04:27 AM
I created the following correlation alerts in ES with Notable
Index=fw (dest_ip=1.2.3.4 OR dest_ip=1.2.3.5)
The alerts in with cron for every 1M
Example:
At 08:00, User A ping 1.2.3.4 At 08:00, User B ping 1.2.3.3
The problem:
If two different users try to get these IPs, I will receive two notable alerts with a drill down. The drill-down will bring the two events from these two different users (mix).
What I expect to receive: 2 separate notable alerts with drill down that will receive only one event (and not the events from the other user)
... View more
Labels
- Labels:
-
correlation search
-
other
06-27-2022
02:12 AM
Thanks for this, but this table will be without "time" (only a list of rules names), and we will not be able to understand when the rules were created.
... View more
06-27-2022
12:30 AM
yes, you're right. bUt, If user will edit the rules this date also will change and we will not be able to monitor old rule creation data (after user will update the rule)
... View more
06-26-2022
11:31 PM
Thanx, but this will give when the rule was updated and not when it was created.
... View more
06-21-2022
07:05 AM
Yes, I am using Splunk 8.X What do I need to do in order to process the access logs to find new CSs?
... View more
06-21-2022
12:34 AM
Hello We have multiple people working on the content in Splunk Enterprise Security, and I need to be able to find when Correlation searches were created What is the way to find it?
... View more
Labels
- Labels:
-
configuration
10-19-2021
09:25 AM
Hi, I want to create a Correlation alert that will trigger and collect all the events from the same IP within a certain time. I try to "group by", but, not work THX
... View more
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-23-2022
11:31 AM
|
