About Yadukrishnan

Yadukrishnan · ‎02-01-2023

Thanks much. That actually worked. I disabled the port 8089 and deployed it from Deployment server. But there are still some servers for which this disabling from deployment server didnt work. Any idea what might be the issue.

Yadukrishnan · ‎01-31-2023

Hi, My Splunk Enterprise security is hosted in Linux servers and the Splunk UF is deployed to both Linux and Windows Operating Systems. Recently Qualys has reported a Vulnerability on the Splunk servers that the UF is listening through port 8089 and is accessible using default password. Can some one help me how to change this default password with out individually log into these large number of end points. Is there any way to centrally do this from Splunk servers.

Yadukrishnan · ‎11-23-2022

Hi, Splunk which I am currently using has all of a sudden increased the log size consumption which has led to my license crossing the threshold. Only have two more warnings left. Have identified a way to filter out some of the Azure logs using regex on the logs. But for some reason the regex is not working. Can someone please help me why this regex is not working. While tested the regex it seems to be working fine but still logs are not getting filtered out even if it matches the criteria. I tested my regex in the online site regex101 and the content seems to match the regex. But still logs are not getting filtered out. Can someone please guide me what would be the reason.

Yadukrishnan · ‎09-19-2022

Hi @scelikok Please see below the sample logs from DDI. Sep 19 08:33:17 host-XX-XX-XX-XX-XX.open.local CEF: 0|Trend Micro|Deep Discovery Inspector|6.2.XXXX|100119|SECURITY_RISK_DETECTION|2|ptype=IDS dvc=XX.XX.XXX.XXX deviceMacAddress=XX:XX:XX:XX:XX:XX dvchost=XXXX deviceGUID=XXXX-XXXX-XXXX-XXXX-XXXX rt=Sep 19 2022 08:33:10 GMT+03:00 appGroup=DNS Response app=DNS Response vLANId=4095 deviceDirection=1 dhost=XX.XX.XX.XX dst=XX.XX.XX.XX dpt=51330 dmac=XX:XX:XX:XX:XX:XX shost=XX.xx.com src=XX.XX.XX.XX spt=53 smac=XX:XX:XX:XX: cs3Label=HostName_Ext cs3=XX.xx.com malType=MALWARE fileType=-65536 fsize=0 ruleId=101 ruleName=DNS response resolves to dead IP address deviceRiskConfidenceLevel=2 cs8Label=BOT_URL cs8=7%3F01 cn3Label=Deep Discovery_PotentialRisk cn3=1 cs4Label=Deep Discovery_SrcGroup cs4=Default cs5Label=Deep Discovery_SrcZone cs5=1 cs9Label=Deep Discovery_DstGroup cs9=Default cs10Label=Deep Discovery_DstZone cs10=1 cs6Label=Deep Discovery_DetectionType cs6=1 pComp=NCIE act=not blocked cn4Label=Deep Discovery_ThreatType cn4=2 peerIp=XX.XX.XX.XX.XX interestedIp=XX.XX.XX.XX cnt=3 cn5Label=AggregatedCount cn5=1 evtCat=Suspicious Traffic evtSubCat=DNS cn2Label=APT Related cn2=0 externalId=47206390 compressedFileType=-65536 compressedFileHash=0000000000000000000000000000000000000000 hostSeverity=1 reason=["Domain: XX.XX.com"] devicePayloadId=2:47206390: In the above logs, the one I have marked in Bold is the signature name. But in Splunk it is showing up as only DNS , none of the other values are showing up. Can you please help to solve this.

Yadukrishnan · ‎09-19-2022

Hi @scelikok, Please see below the sample logs from DDI. Sep 19 08:33:17 host-XX-XX-XX-XX-XX.open.local CEF: 0|Trend Micro|Deep Discovery Inspector|6.2.XXXX|100119|SECURITY_RISK_DETECTION|2|ptype=IDS dvc=XX.XX.XXX.XXX deviceMacAddress=XX:XX:XX:XX:XX:XX dvchost=XXXX deviceGUID=XXXX-XXXX-XXXX-XXXX-XXXX rt=Sep 19 2022 08:33:10 GMT+03:00 appGroup=DNS Response app=DNS Response vLANId=4095 deviceDirection=1 dhost=XX.XX.XX.XX dst=XX.XX.XX.XX dpt=51330 dmac=XX:XX:XX:XX:XX:XX shost=XX.xx.com src=XX.XX.XX.XX spt=53 smac=XX:XX:XX:XX: cs3Label=HostName_Ext cs3=XX.xx.com malType=MALWARE fileType=-65536 fsize=0 ruleId=101 ruleName=DNS response resolves to dead IP address deviceRiskConfidenceLevel=2 cs8Label=BOT_URL cs8=7%3F01 cn3Label=Deep Discovery_PotentialRisk cn3=1 cs4Label=Deep Discovery_SrcGroup cs4=Default cs5Label=Deep Discovery_SrcZone cs5=1 cs9Label=Deep Discovery_DstGroup cs9=Default cs10Label=Deep Discovery_DstZone cs10=1 cs6Label=Deep Discovery_DetectionType cs6=1 pComp=NCIE act=not blocked cn4Label=Deep Discovery_ThreatType cn4=2 peerIp=XX.XX.XX.XX.XX interestedIp=XX.XX.XX.XX cnt=3 cn5Label=AggregatedCount cn5=1 evtCat=Suspicious Traffic evtSubCat=DNS cn2Label=APT Related cn2=0 externalId=47206390 compressedFileType=-65536 compressedFileHash=0000000000000000000000000000000000000000 hostSeverity=1 reason=["Domain: XX.XX.com"] devicePayloadId=2:47206390: In the above logs, the one I have marked in Bold is the signature name. But in Splunk it is showing up as only DNS , none of the other values are showing up. Can you please help to solve this.

Yadukrishnan · ‎09-19-2022

Hi, I integrated Trendmicro DDI with Splunk using the app. But in DDI, there is a gap in the signature name. Therefore when Splunk is parsing the signature name, it is only showing the first word and not the rest. For example if the signature name is "possible scanning activity" , I could see only in Splunk that the signature nae is "Possible" . The remaining is not coming up. Can some one please help with this. This is something very urgent.

Yadukrishnan · ‎07-09-2022

Hi all, I am currently configuring Splunk Enterprise Security for Alerts. I have a doubt in the implementation of this solution. I created a alert for Failed logins from Windows devices. If this alert is triggered, team is running some queries manually to collect more details such as the pattern of that user account in the past 30 days, or the servers to which the user account has logged in the past 30 days to identify a baseline or to investigate whether there are any anomaly in the usage of that account. My doubt is whether there are any way to automate this process. Like if the above alert triggers, then the subsequent queries which the team is currently running manually can be automated and show the results some where in the alert itself where the team can go and see either in tabular or graphical format. Could you please suggest a solution for this. Any input on how to set up Enterprise security as a SOC detection and workflow is much appreciated.

Yadukrishnan · ‎03-04-2022

Hi, Is it possible to make use of multiple indexes in one query. Below is the use case which I am trying to implement. If the connection from a IP address has a threat signature match in IPS, then look for the same address in WAF and if the WAF action is alerted, then trigger the alert. If the WAF action is blocked, then the alert can be suppressed. Is it possible to implement this use case. I am just trying to fine tune our detection capabilities as much as possible.

Yadukrishnan · ‎01-26-2022

Hi, I have installed and configured Palo Alto Addon which is creating multiple eventtypes , one of which is pan_traffic_start which I believe are the session start logs. I want to remove these particular event types from the logs so that the license can be saved since much value are not there from these logs. Can someone please help me in filtering out this eventype so that they will not reach indexers or search headers.

Posts	9
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎01-26-2022

Online Status	Offline
Date Last Visited	‎02-02-2023 03:05 AM

How to change universal forwarder default password...

Need urgent help to filter out logs

Integrate Trendmicro DDI with Splunk- Not parsing ...

Setting up Enterprise Security as a SOC detection-...

Create query to lookup multiple indexes

Filter out pan_traffic_start eventtype

Re: Change Universal Forwarder default password in...