Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About tmwhitm
tmwhitm
New Member
Member since:
06-21-2017
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-21-2017 |
Activity Feed
- Posted stix Threat Intelligence Upload on Splunk Enterprise Security. 12-04-2018 10:39 AM
- Tagged stix Threat Intelligence Upload on Splunk Enterprise Security. 12-04-2018 10:39 AM
- Tagged stix Threat Intelligence Upload on Splunk Enterprise Security. 12-04-2018 10:39 AM
- Tagged stix Threat Intelligence Upload on Splunk Enterprise Security. 12-04-2018 10:39 AM
- Tagged stix Threat Intelligence Upload on Splunk Enterprise Security. 12-04-2018 10:39 AM
- Posted Re: Can you help me with the following regex expression? on Splunk Enterprise Security. 10-05-2018 12:04 PM
- Posted Re: Can you help me with the following regex expression? on Splunk Enterprise Security. 10-05-2018 11:04 AM
- Posted Re: Can you help me with the following regex expression? on Splunk Enterprise Security. 10-05-2018 11:02 AM
- Posted Can you help me with the following regex expression? on Splunk Enterprise Security. 10-05-2018 10:28 AM
- Tagged Can you help me with the following regex expression? on Splunk Enterprise Security. 10-05-2018 10:28 AM
- Tagged Can you help me with the following regex expression? on Splunk Enterprise Security. 10-05-2018 10:28 AM
- Tagged Can you help me with the following regex expression? on Splunk Enterprise Security. 10-05-2018 10:28 AM
- Posted Re: Netscaler Syslog to Sylog-ng over TCP Failing on Getting Data In. 09-07-2018 05:56 AM
- Posted Netscaler Syslog to Sylog-ng over TCP Failing on Getting Data In. 09-05-2018 10:43 AM
- Tagged Netscaler Syslog to Sylog-ng over TCP Failing on Getting Data In. 09-05-2018 10:43 AM
- Tagged Netscaler Syslog to Sylog-ng over TCP Failing on Getting Data In. 09-05-2018 10:43 AM
- Tagged Netscaler Syslog to Sylog-ng over TCP Failing on Getting Data In. 09-05-2018 10:43 AM
- Posted Re: Lookup Tabel with UrLs on Splunk Search. 06-07-2018 04:31 AM
- Posted Re: Lookup Tabel with UrLs on Splunk Search. 06-07-2018 04:20 AM
- Posted Lookup Tabel with UrLs on Splunk Search. 06-06-2018 12:35 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-04-2018
10:39 AM
Splunkers,
Once a stix formatted IOC file has been successfully uploaded via Splunk Enterprise Security "Upload Threat Intelligence", I'd like to view the contents of that upload to review the IOCs but I have not been able to see that information, let alone the file listed anywhere. There is an SA-SPLICE application in Splunkbase but that has not been updated since 2015 and doesn't support the latest file formats.
Where in Splunk ES can I view the contents of the uploaded IOC?
How can I confirm the IOC is enabled and providing intel to Splunk ES?
Thank you,
Tom
... View more
10-05-2018
12:04 PM
That seemed to work very well. Thank you...
... View more
10-05-2018
11:04 AM
Hi Vijeta, this rex did not work, I received the same error message. I added an example of an event to the post above, that rex did work but I am still missing something with regards to the rex command.
... View more
10-05-2018
11:02 AM
Your rex worked, no error but here is an example of the event. My other question if you would be so kind, I was under the impression that the rex command would change the content of the field name, 'subject' in this case to only contain the result of the rex command, "0x16cbfadd7" from the example below but it doesn't. Where am I wrong?
10/5/18
1:38:55.000 PM
10/05/2018 01:38:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=AD04.ad.net
TaskCategory=Logoff
OpCode=Info
RecordNumber=826696385
Keywords=Audit Success
Message=An account was logged off.
Subject:
Security ID: AD\xxxxxxx
Account Name: xxxxxxx
Account Domain: AD
Logon ID: 0x16cbfadd7
Logon Type: 3
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
... View more
10-05-2018
10:28 AM
I have been reviewing answers from this forum & Splunk doc but I can't seem to find out why my rex command keeps throwing the error, "Error in 'rex' command: Encountered the following error while compiling the regex '(?<='Logon': Regex: missing closing parenthesis". My rex looks similar to others in this forum and works great on regex101 but I am obviously missing something. Here is my SPL,
source="wineventlog:Security" user=xxxxx (EventCode=4624 OR EventCode=4634)
| rex field=subject (?<=Logon ID:)(.*)(?=\b)
| eval Account_Name=mvindex(Account_Name,1)
| eval User=coalesce(Account_Name,Logon_Account,Logon_account,User_Name)
| eval User=lower(User)
Any guidance is appreciated.
Tom
... View more
09-07-2018
05:56 AM
Thanks Frobert. This is from a tcpdump on the syslog-ng server,
Netscaler --> Syslog-ng (SYN)
Syslog-ng --> Netscaler (SYN, ACK)
Netscaler --> Syslog-ng (FIN, ACK)
Syslog-ng --> Netscaler (FIN, ACK)
Netscaler --> Syslog-ng (ACK)
The three-way handshake never completes. I am researching as a possible source of the issue a mismatch in the MSS of the TCP Packet.
In the SYN packet, an MSS of 1380 is sent,
TCP Option - Maximum segment size: 1380 bytes
The syslog-ng server responds with an MSS of 1460
TCP Option - Maximum segment size: 1460 bytes
The very next packet is the FIN,ACK. My theory right now is that the two servers cannot agree on the correct MSS and am researching with the Netscaler admin.
Thank you,
... View more
09-05-2018
10:43 AM
Splunk Community,
I have a Netscaler appliance configured to send syslog data to a syslog-ng server over TCP/9524. The TCP connection is reaching the sylog-ng server but never completes the handshake.
Netscaler --> Syslog-ng (SYN)
Syslog-ng --> Netscaler (SYN, ACK)
Netscaler --> Syslog-ng (FIN, ACK)
Syslog-ng --> Netscaler (FIN, ACK)
Netscaler --> Syslog-ng (ACK)
We have multiple TCP connections on various other ports connecting fine to this Syslog-ng server. Wondering if anyone else has had this experience or suggestions to remediate. Most appreciated.
Thank you,
Tom
... View more
06-07-2018
04:31 AM
Yes, my data had www.example.com so I added that verbatim to the lookup table but the data was not found until I added www.example.com to the lookup table.
... View more
06-07-2018
04:20 AM
Jkat54,
Thank you. Before your post I was playing with the lookup table and found that when I added a wildcard at the beginning and end of the url, the SQL I have worked. Still trying to wrap my mind around why for even when I tested www.example.com and it existed in the data, it was not found until I added the wildcard.
... View more
06-06-2018
12:35 PM
Looking for assistance in creating a lookup table with UrLs, my syntax below does not work. Any ideas on how to use a lookup table with UrLs?
index="p*" [ | inputlookup UrL-Input | stats values(UrL) as url | format ] | stats count by src_ip,url,action
| sort action
The lookup table UrL-Input contains two columns, URL & Description.
Any assistance is appreciated.
Tom
... View more
06-06-2018
12:04 PM
The syntax in the accepted answer works great but when I create a lookup table with UrLs, it does not work. Any ideas on how to use a lookup table with UrLs? I have SPL like this that isn't working,
index="p*" [ | inputlookup UrL-Input | stats values(UrL) as url | format ] | stats count by src_ip,url,action
| sort action
The lookup table UrL-Input contains two columns, URL & Description.
Any assistance is appreciated.
Tom
... View more
03-12-2018
08:37 AM
Need to install a second heavy forwarder and doing so seems to be more difficult than it should be.
Is there a separate download for a heavy forwarder? I do not see such an instance in the download section, only universal forwarders.
If not, what needs to be downloaded?
How does it get configured?
Does the heavy forwarder require a separate license?
We have been told, via Professional Services that the heavy forwarder was akin to the universal forwarder in that it did not require a separate license. After opening a ticket with tech support, it has been stated that we do. Splunk documentation is robust but at the same time very arduous to work through and information from tech support & Splunk engineers is not always along the same path. I appreciate any direction anyone can provide to the questions above.
Thank you,
Tom
... View more
12-08-2017
11:30 AM
Just tried it and working with a control IP i added to the lookup table. Thank you very much!
... View more
12-08-2017
10:52 AM
I am looking for a way to perform a search and produce results matching search results against a lookup table or vice versa. The scenario is a lookup table with two columns, IP & Description. I wish to run a search and produce results on the IP addresses that match the IP addresses in the lookup table. My syntax is not correct on what I have been able to test, see below for the SPL I was using. I know there must be a straight forward way to accomplish this task. Much appreciated for any support.
Thank you,
Tom
index="network" sourcetype="cisco:asa" | join src_ip [ search inputlookup append=t FLASHAB000089 | rename IPAddr as src_ip]
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
