Salam Splunkers, I’m having a problem while configuring the Windows Remote Management app with the Splunk SOAR platform. When testing the connectivity with the transport type set to NTLM, it fails and displays an error message. Following the error message, I disabled FIPS mode on the Windows Server and tested the connectivity again, but the issue persists. I then changed the transport type to Kerberos, but ran into a different issue. I have a  few questions: Is the targeted system for integration with this app the Windows Server or the Windows\Linux endpoint? Do we need to integrate the Windows Server itself in order to access the endpoints listed under the AD domain of that Windows Server with this app? Any guidance would be appreciated! ... View more

What is the reason that Splunk UBA Kafka  give me this error, how can i fix this Kafka topics are not receiving events and Kafka Broker ... View more

Salam guys I wrote the Correlation Search Query and added the Adaptive Response Actions (notable, risk analysis and send to soar), but when the event goes to soar there's no event_id in the artifacts SPL Query: [ | tstats summariesonly=true values("Authentication.user") as "user",values("Authentication.dest") as "dest",count("Authentication.dest") as "dest_count",count("Authentication.user") as "user_count",count from datamodel="Authentication"."Authentication" where nodename="Authentication.Failed_Authentication" by "Authentication.src","Authentication.app" | rename "Authentication.src" as "src","Authentication.app" as "app" | where 'count'>5 ] ... View more

Hi guys  when I extract a selected event it doesn't show all data in event that I need to extracted ... View more

how can I make the Splunk agent collect the web Brower or network logs from Endpoint (windows, Linux) to the Splunk Server  ... View more

In Splunk ES and the platform, this error keeps appearing and I couldn't resolve it. Could not load lookup=LOOKUP-useragentstrings ... View more

Why does the Approval settings work in some actions and not in others? ... View more

Hi everyone, Is there a way to speed up the Splunk SOAR capabilities to process the events, it can't process a 100 events every 5 minutes....  I found a solution about the worker but, the file that solution talk about doesn't exists which is "umsgi.ini" ... View more

is there playbook for this kind of thing? playbook "user password policy enforcement " ... View more

How can SOAR be set up to receive data from Splunk ES, process it, send an action to the endpoints, and update the event status in Splunk ES? ... View more

Hi, how can I Forwarding events From Splunk Enterprise TO SOAR automatically ? ... View more