How did you correct it?  Please share to help others. ... View more

Hi @KingUs80 , see in the Splunk Security Essentials App (https://splunkbase.splunk.com/app/3435), or, if you already have, in Enterprise Security Premium App. The feature in ES is Threat Intelligence: you must have an internal list of malicious sites of a list downloaded from free or payment services. Other apps that you could use are MISP42 (https://splunkbase.splunk.com/app/4335) or https://splunkbase.splunk.com/apps?keyword=threat+intelligence  Ciao. Giuseppe ... View more

@dtburrows3  Thank you very much for your assistance. The query works perfectly without: | where 'days_since_last_login'>14 I tried to play with the number of days after > , but it is still failing (returning no events). Other than that, everything works well. ... View more