Hi I want to search for sysmon events in splunk  my current search: index=* sourcetype="WinEventLog:Microsoft-Windows-sysmon/operation" Registry I'm trying to identify any persistence in the system, is that the correct filter for Splunk search?   Thanks ... View more

Hi     I've tried all the below solutions and still no luck index=* sourcetype="suricata" "*23.216.147.64*" index=* sourcetype="fortigate_utm" "*23.216.147.64*" index=* sourcetype="fortigate_traffic" "*23.216.147.64*" index=* sourcetype="fortigate_event" "*23.216.147.64*" index=* sourcetype="firewall" "*23.216.147.64*" index=* sourcetype="sysmon" "*23.216.147.64*" index=* sourcetype="xmlwineventlog" "*23.216.147.64*" index=* sourcetype="xmlwineventlog:microsoft-windows-sysmon/operation" "*23.216.147.64*" index=* sourcetype="WinEventLog:Security" "*23.216.147.64*"   Tony ... View more

Hi     Sanjay, I've all the possible filters  and still not manage to find details about the  IP index=* sourcetype="suricata" "*23.216.147.64*" index=* sourcetype="fortigate_utm" "*23.216.147.64*" index=* sourcetype="fortigate_traffic" "*23.216.147.64*" index=* sourcetype="fortigate_event" "*23.216.147.64*" index=* sourcetype="firewall" "*23.216.147.64*" index=* sourcetype="sysmon" "*23.216.147.64*" index=* sourcetype="xmlwineventlog" "*23.216.147.64*" index=* sourcetype="xmlwineventlog:microsoft-windows-sysmon/operation" "*23.216.147.64*" index=* sourcetype="WinEventLog:Security" "*23.216.147.64*" can you please help me what I could be doing wrong ? Thank tony ... View more