Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About spctravis
spctravis
Explorer
Member since:
06-20-2022
09-20-2022
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 06-20-2022 |
Activity Feed
- Posted Re: Risk isn't showing up in the Edit Correlation Search on Splunk Enterprise Security. 09-20-2022 06:24 AM
- Posted Risk isn't showing up in the Edit Correlation Search? on Splunk Enterprise Security. 09-16-2022 04:57 AM
- Karma Re: audit/monitor administrative activity to Splunk for gcusello. 08-29-2022 06:37 AM
- Posted How to audit/monitor administrative activity to Splunk? on Monitoring Splunk. 08-24-2022 07:37 AM
- Posted Universal forwarder doesn't have a default setting in inputs.conf for Microsoft-Windows-PowerShell/Operational on Getting Data In. 06-27-2022 02:43 PM
- Tagged Universal forwarder doesn't have a default setting in inputs.conf for Microsoft-Windows-PowerShell/Operational on Getting Data In. 06-27-2022 02:43 PM
- Tagged Universal forwarder doesn't have a default setting in inputs.conf for Microsoft-Windows-PowerShell/Operational on Getting Data In. 06-27-2022 02:43 PM
- Tagged Universal forwarder doesn't have a default setting in inputs.conf for Microsoft-Windows-PowerShell/Operational on Getting Data In. 06-27-2022 02:43 PM
- Posted Updated DB Connect, now my connections don't work; MS-SQL Server Using MS Generic Driver With Kerberos Authentication on Getting Data In. 06-20-2022 03:18 PM
- Tagged Updated DB Connect, now my connections don't work; MS-SQL Server Using MS Generic Driver With Kerberos Authentication on Getting Data In. 06-20-2022 03:18 PM
- Tagged Updated DB Connect, now my connections don't work; MS-SQL Server Using MS Generic Driver With Kerberos Authentication on Getting Data In. 06-20-2022 03:18 PM
- Tagged Updated DB Connect, now my connections don't work; MS-SQL Server Using MS Generic Driver With Kerberos Authentication on Getting Data In. 06-20-2022 03:18 PM
- Tagged Updated DB Connect, now my connections don't work; MS-SQL Server Using MS Generic Driver With Kerberos Authentication on Getting Data In. 06-20-2022 03:18 PM
- Tagged Updated DB Connect, now my connections don't work; MS-SQL Server Using MS Generic Driver With Kerberos Authentication on Getting Data In. 06-20-2022 03:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-20-2022
06:24 AM
I want to be able to add the risk using .conf files not go through the gui. 800 plus rules is too many to one by one.
... View more
09-16-2022
04:57 AM
I have an app with my alerts. I have risk enabled and it's working however risk isn't showing up in the Edit Correlation Search menu. Is there a setting in a .conf file I am missing? I looked into alert_actions.conf but don't see any other rule with that linking to it. Below is my risk setting for one of my rules:
action.risk = 1 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 14}] action.risk.param._risk_message = Wsmprovhost.exe spawned a LOLBAS process on $dest$. action.risk.param._risk_score = 0 action.risk.param.verbose = 0
... View more
Labels
- Labels:
-
risk analysis
08-24-2022
07:37 AM
We are trying to audit/monitor administrative activity to Splunk. Is there some canned dashboards or searches that can be used to monitor/review elevated privilege activity? How do we monitor change management on Splunk itself?
... View more
Labels
- Labels:
-
audit
06-27-2022
02:43 PM
Splunkers, I want to get in Microsoft-Windows-PowerShell/Operational logs into Splunk. There is no default setting for it in the default/inputs.conf file. I think this is the answer: [WinEventLog://Microsoft-Windows-PowerShell/Operational] disabled=0
... View more
Labels
- Labels:
-
universal forwarder
06-20-2022
03:18 PM
Splunkers, I just updated my app db_connect. Now all my connections are broken. I think they are forcing ssl now and that has broken them. This is error that produces: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target". I tried setting the key value pair to encrypt=false. I then get this error and my Server team says it's no longer using Kerberos. Login failed for user 'SVCSplunkDBRead'. ClientConnectionId:5fb7a943-44bb-46ce-bf52-63a9c90643df Any advice on how to fix the issue would be super awesome! I don't think the server team is going to turn on SSL right now. These are my local confs: inputs.conf [http://db-connect-http-input] disabled = 0 db_connection.conf [EEHProd] connection_type = generic_mssql_kerberos database = EnterpriseExceptionSystem disabled = 0 host = SQLSERVER identity = SplunkDBRead jdbcUseSSL = true localTimezoneConversionEnabled = false port = 1433 readonly = true timezone = America/Denver customizedJdbcUrl = jdbc:sqlserver://SQLSERVER:1433;databaseName=EnterpriseExceptionSystem;selectMethod=cursor;encrypt=true;MultiSubNetFailover=True identities.conf [SplunkDBRead] disabled = 0 domain_name = ipce password = somepassword use_win_auth = true username = SVCSplunkDBRead identity_type = normal
... View more
Labels
- Labels:
-
Windows
