Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About treven
treven
Explorer
Member since:
07-28-2023
07-02-2024
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 07-28-2023 |
Activity Feed
- Posted Re: 500 Internet Server Error when Update Apps/Add-Ons on Splunk Dev. 06-21-2024 07:24 AM
- Posted App Builder: Create Alert Actions on Splunk Dev. 06-10-2024 08:10 AM
- Posted Re: How to resolve error's while installing Splunk SOAR? on Splunk SOAR. 05-15-2024 02:01 PM
- Posted Re: Splunk ES Adaptive Response | Custom Local Scripts using Dynamic Variables to query external APIs on Other Usage. 05-03-2024 10:31 AM
- Posted Re: Read Only Executive Summary Splunk ES on Splunk Enterprise Security. 05-03-2024 10:26 AM
- Karma Re: Read Only Executive Summary Splunk ES for TheLawsOfChaos. 05-03-2024 10:22 AM
- Karma Re: Splunk ES - Configuration file settings may be duplicated in multiple apps for harsmarvania57. 05-03-2024 10:21 AM
- Posted Re: Splunk ES - Configuration file settings may be duplicated in multiple apps on Reporting. 05-03-2024 10:18 AM
- Posted Re: Is there a way to run a search with an adaptive response? on Splunk Enterprise Security. 03-27-2024 10:21 AM
- Posted Read Only Executive Summary Splunk ES on Splunk Enterprise Security. 02-21-2024 12:43 PM
- Tagged Splunk ES Adaptive Response | Custom Local Scripts using Dynamic Variables to query external APIs on Other Usage. 02-05-2024 12:49 PM
- Posted Splunk ES Adaptive Response | Custom Local Scripts using Dynamic Variables to query external APIs on Other Usage. 02-05-2024 12:15 PM
- Karma Re: Extracting Attachments for gcusello. 07-28-2023 11:57 AM
- Karma Re: Extracting Attachments for gcusello. 07-28-2023 11:57 AM
- Posted Re: Extracting Attachments on Splunk Search. 07-28-2023 08:34 AM
- Karma Re: Extracting Attachments for gcusello. 07-28-2023 08:34 AM
- Posted Re: Extracting Attachments on Splunk Search. 07-28-2023 08:32 AM
- Posted Re: Extracting Attachments on Splunk Search. 07-28-2023 08:05 AM
- Posted Re: Extracting Attachments on Splunk Search. 07-28-2023 06:57 AM
- Posted Re: Extracting Attachments on Splunk Search. 07-28-2023 06:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-21-2024
07:24 AM
This is very old, but did anyone ever figure this out? We've had a ticket open for a month now about this exact issue and have chased down every error message and possible conf change. If anyone out there has a possible solution or suggestion for this that would be awesome! Thanks everyone!!
... View more
06-10-2024
08:10 AM
Hey everyone! Would anyone have any resources on how this works we have working scripts mostly external api calls that are working in the testing environment however when attempting to configure the app to work as an adaptive response action we are running into some problem. Are there any resources out there on this at all, we have been unable to find anything really help on this section or anyone to really offer any insight or guidance into how this is supposed to work. Any insight or suggestions at all would be greatly appreciated, thank you in advance!!
... View more
05-15-2024
02:01 PM
Hey I know this is old but did you ever figure this out i am getting the same errors. Thanks!
... View more
05-03-2024
10:31 AM
@Albert_Cyber , Kind of, we are in the process of creating custom apps for these use cases and adaptive response actions. The only problem is it really is a pain to create a whole app to just make some very simple api calls and run basic commands like dig against a specified variable. We are following: Create an AR action | Documentation | Splunk Developer Program the guidance from these docs as there isn't much out there on it and I'm more of a bash scripter than a python programmer so it is a very slow process for us.
... View more
05-03-2024
10:26 AM
Sorry for the late response on this but this is exactly what we did created a user and role separate from the others exec_view and assigned that role read-only permissions and assigned it to specific users. Thanks for the information!
... View more
05-03-2024
10:18 AM
This exact scenario just happened in our environment as well and it turned out a savedsearch with the same name was under a different user. Thank you for providing this old but still applicable post!
... View more
03-27-2024
10:21 AM
This is a pretty old post but were you ever able to figure out a solution to this? I am currently exploring these options with a custom adaptive response. Thanks!
... View more
02-21-2024
12:43 PM
Is there a way to give a user read-only access to only a specific dashboard on Splunk ES such as the Executive Summary dashboard? Any assistance would be greatly appreciated! *Edit Sorry we have the user role and user created but we are unable to restrict it to a single dashboard, we can specify an app such as ES but have been unsuccessful in getting a default dashboard set. When you land on ES there is the "Security Posture" "Incident Review" "App Configuration" etc settings. Would it be possible to change one of these from "Security Posture" to "Executive Summary" so that way they are just a click away from the appropriate dashboard? Thank you!
... View more
Labels
- Labels:
-
configuration
02-05-2024
12:15 PM
Hey Everyone! We just started using Splunk ES, we just got it up and running fairly well and I have a couple questions hopefully I could get some guidance on or maybe a point in the right direction. I would like to somehow setup the ability for analyst to be able to run local scripts in the adaptive response that use dynamic user input as variables to query external APIs. Another scenario, I was hoping we could use, would be using specific tokens/fields as the dynamic variable for these scripts and just give the analyst the output in the adaptive response when they are ran. Are any of these scenarios possible with ES we have tried to find a way to do this but so far have not come up with any successful implementation. Is there any documentation on implementing something like this? Any help would be very much appreciated!
... View more
- Tags:
- splunkes
07-28-2023
08:34 AM
@gcusello , This worked really well! Thank you very much for your assistance!
... View more
07-28-2023
08:32 AM
@gcusello That did it! Thank you very much for your assistance with this!
... View more
07-28-2023
08:05 AM
So, I was able to get the field extractor to do both png and jpg but any other selected field results in an error. I suppose I could create separate fields and use eval to somewhat accomplish what I am looking for. Here are some examples: date=2023-07-28 time=09:00:22.791 device_id=10000 log_id=000123 type=spam subtype=default pri=information session_id="1138-7644" client_name="" client_ip="1.1.1.1" dst_ip="1.1.1.1" from="email" to="email" subject="TITLE" msg="Antispam identified spam URL: http://website.jpg" date=2023-07-28 time=08:51:25.640 device_id=02222 log_id=00023 type=virus subtype=sandbox pri=information from="" to="" client_name="" client_ip="" session_id="1000-0322" msg="File file.pdf has been sent to Sandbox"
... View more
07-28-2023
06:57 AM
Yeah absolutely, I will post it soon. Thanks for your assistance.
... View more
07-28-2023
06:52 AM
Yes that is correct I am just looking to monitor the various types of attachment types. As I stated in my post, the field extracting feature is only allowing one type of attachment. It will only extract .jpg fields and will ignore pdf or png. If I try to add another by selecting it in an event, I will get an error.
... View more
07-28-2023
06:27 AM
I am attempting to extract attachment fields from our email logs using regex. Attachments like .jpg, .png, pdf, etc. I have gone through the process of using the SPL field extracting feature however it usually results in only one attachment type being selected or another, if I try and select other attachment types the extraction fails. Any suggestions would be greatly appreciated. Thank you.
... View more
Labels
- Labels:
-
field extraction
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-02-2024
09:23 AM
|
