Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About splk_user
splk_user
Path Finder
Member since:
06-16-2023
07-12-2023
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 0 |
| Member Since | 06-16-2023 |
Activity Feed
- Posted I can't find ubuntu sucessful authentication log on Getting Data In. 07-12-2023 03:56 AM
- Tagged I can't find ubuntu sucessful authentication log on Getting Data In. 07-12-2023 03:56 AM
- Tagged I can't find ubuntu sucessful authentication log on Getting Data In. 07-12-2023 03:56 AM
- Tagged I can't find ubuntu sucessful authentication log on Getting Data In. 07-12-2023 03:56 AM
- Posted Re: How to integrate openCTI with splunk on Getting Data In. 07-12-2023 01:51 AM
- Karma Re: How to integrate openCTI with splunk for richgalloway. 07-12-2023 01:51 AM
- Tagged Re: How to integrate openCTI with splunk on Getting Data In. 07-12-2023 01:51 AM
- Posted How to integrate threat intel platform in splunk (OpenCTI) on Getting Data In. 07-11-2023 12:36 PM
- Tagged How to integrate threat intel platform in splunk (OpenCTI) on Getting Data In. 07-11-2023 12:36 PM
- Tagged How to integrate threat intel platform in splunk (OpenCTI) on Getting Data In. 07-11-2023 12:36 PM
- Tagged How to integrate threat intel platform in splunk (OpenCTI) on Getting Data In. 07-11-2023 12:36 PM
- Tagged How to integrate threat intel platform in splunk (OpenCTI) on Getting Data In. 07-11-2023 12:36 PM
- Posted Re: How to integrate openCTI with splunk on Getting Data In. 07-11-2023 12:24 PM
- Karma Re: How to integrate openCTI with splunk for richgalloway. 07-11-2023 05:39 AM
- Posted Re: How to integrate openCTI with splunk on Getting Data In. 07-11-2023 02:10 AM
- Karma Re: How to integrate openCTI with splunk for richgalloway. 07-11-2023 01:58 AM
- Posted Re: How to integrate openCTI with splunk on Getting Data In. 07-09-2023 02:40 PM
- Tagged Re: How to integrate openCTI with splunk on Getting Data In. 07-09-2023 02:40 PM
- Karma Re: How to integrate openCTI with splunk for richgalloway. 07-09-2023 02:34 PM
- Posted How to integrate openCTI with Splunk? on Getting Data In. 07-07-2023 04:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-12-2023
03:56 AM
Hi! i have configred ubuntu machine to send authentication log to my splunk instance using syslog. But i found just the failed auth logs and other logs with the field " pam_unix(cron:session)". i am looking for the successful authentication that have the field "pam_unix(login:session)" and i find just pam_unix(sudo:session) Do i need to use add-on for unix and linux ? Any advice, tips, or resources you can provide will be highly appreciated Thank you
... View more
Labels
- Labels:
-
data
-
inputs.conf
-
Linux
-
monitor
-
syslog
07-11-2023
12:36 PM
Hi! i want to integrate OpenCTI intel feeds to splunk and i don't find any Add-on for this integration . OpenCTI provide a connector for this connection but what is the configuration that i need to provide in splunk to receive the feeds . Can you Please suggest if there is any specific guide for how to do this with opencti ; Thank you
... View more
Labels
07-11-2023
12:24 PM
thank you , Well i tested the OpenCTI connector but the connection didn't work . Do i need to set up a kv store before or maybe i need to configure HTTP Event Collector in order to integrate opencti to splunk. i don't know also if this issues has a relation with REST API connection The objective is to receive intelligence feeds from opencti platform in STIIX format to my splunk instance. NB: - I don't have the splunk entreprise app that provide the threat intelligence management section - I'm using the free trial
... View more
07-11-2023
02:10 AM
Thank you for your response, i checked the provided link, and i found that openCTI needs this information : So what value will the variable "SPLUNK_TOKEN=Token1" and "SPLUNK_OWNER=nobody " take ? And now do i still need to configure a sourcetype in props.conf for the data ? NB: i checked the props.conf file and i found just the syslog configuration
... View more
07-09-2023
02:40 PM
Thank you for your answers, So there is no configuration to do in splunk platform for this connection
... View more
- Tags:
- t
07-07-2023
04:08 AM
Hi!
I'm currently working on a project where I aim to integrate the OpenCTI platform with Splunk in order to receive intelligence feeds, how can i configure the ingestion of this intelligence feeds ?
Any advice, tips, or resources you can provide will be highly appreciated
... View more
- Tags:
- CTI
- intelligence feed
Labels
- Labels:
-
kvstore
06-20-2023
06:51 AM
yes ofcourse here it is
... View more
06-20-2023
05:00 AM
i have checked in the event viewer and the event 4625 is being generated but i still have the same problem they are not appering in splunk instance
... View more
06-20-2023
04:58 AM
Thank you @gcusello , But i have checked inputs.conf and the Eventcode=4625 is not blacklisted in the configuration. and when i checked Event Viewer of the Windows host, i found that logs with event code 4265 are generated
... View more
06-19-2023
08:55 AM
Yes, I have checked the Windows Host on the Event Viewer of the machine and I have found event logs with the event ID 4265 but they are not appearing in Splunk Instance
... View more
06-16-2023
05:20 AM
Hi,
I'm experiencing an issue where logs with EventCode=4625 from Windows systems (an account failed to log on) are not appearing in my Splunk instance. I have checked the data collection and indexing settings, but still can't find these logs.
Has anyone else encountered a similar problem or have any suggestions on how to troubleshoot this? .
Thank you!
... View more
Labels
- Labels:
-
Windows
06-16-2023
05:07 AM
Thank you @PickleRick
... View more
06-16-2023
05:06 AM
Thank you @gcusello
... View more
06-16-2023
01:22 AM
Hi, Is it possible to monitor Windows event log via WMI to splunk instead of using Universal Forwarder? if yes, how can i configure this communication. Thanks.
... View more
Labels
- Labels:
-
universal forwarder
-
Windows
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-12-2023
10:56 AM
|
