Hi All, I am trying to tune up a notable called DNS Query Length Outliers Using the MLTK App to set up the data, but the number of the notables remain the same. Am I doing something wrong? I followed some instructions on how to build the data model required for the notable to work, but still no luck. Worth mention that when I run the SPL in the Search, it delivers different number of notables. What  option shall I use from the "Experiments" within the MLTK App to make the data work for the notable. The code is from here: https://github.com/splunk/security_content/blob/develop/detections/experimental/network/dns_query_length_outliers___mltk.yml   Thank you in advance. ... View more

Hi to All, I need help with creating an Active Directory changes report.  I used Win Events like 4728, 4729, 4730 but could not print to PDF  Is there a search that will return all changes creation, deletion of global groups?  Thank you! ... View more