My splunk services wont start    06-17-2020 11:13:37.100 -0400 ERROR BTreeCP - open failed to restore checkpoint in btree='/opt/splunk/var/lib/splunk/fishbucket/splunk_private_db', it may be corrupted -- run `SPLUNK_HOME/bin/btprobe -d '/opt/splunk/var/lib/splunk/fishbucket' -r` to attempt to repair   This splunk is enterprise security plus heavy forwarder and has version 7.x on it. All my other servers are on 8.x.   Due to lot of dependencies on python 2.7 we did not upgrade this one but it worked fine for many months. ... View more

In Splunk when i ingest Security events log of AD from 70 domain controllers for just 4 whitelisted events and dropping static text by regex in config file and the count is 500gb avg. everyday. In Azure sentinel when we ingest the same data i mean like ingest these 4 events by Azure sentinel connector from our domain controllers the amount/size of logs is just 10gb. i am surprised and want to know what is the difference in terms of logs ingestion or processing that there is so huge difference in terms of size. ... View more

I have these events on Splunk ES security posture dashboard and need help in understand how the detection for this one particular investigation works below is the example of this event we are investigating 04/22/2019 06:35:00 -0400, search_name="Threat - File Name Matches - Threat Gen", search_now=1555929300.000, info_min_time=1555840800.000, info_max_time=1555929300.000, info_search_time=1555929301.836, dest="::", file_name="Setup.exe", orig_sourcetype="cisco:sourcefire", src="10.143.24.83|10.143.6.14", threat_collection=file_intel, threat_collection_key="mandiant:package-190593d6-1861-4cfe-b212-c016fce1e240:mandiant:observable-dedc26f8-efce-45e0-80c5-b1ed8a00cd89", threat_key="mandiant:package-190593d6-1861-4cfe-b212-c016fce1e240|Appendix_G_IOCs_No_OpenIOC.xml", threat_match_field=file_name, threat_match_value="Setup.exe" Threat detection reference https://jar-download.com/artifacts/org.mitre/stix/1.2.0.2/source-code/schemas/v1.2.0/samples/APT1/Appendix_G_IOCs_No_OpenIOC.xml Using the file name i could trace down to one of the users who was trying to download snoopwpf which is "a app that allows you to spy/browse the visual tree of a running application (without the need for a debugger) ... and change properties ... amongst other things." how does this investigation of Splunk ES work is it solely based on file name or more? ... View more

We are using McAfee DATABASE ACTIVITY MONITOR solution and have integerated it with Splunk and do not get much fields even in verbose mode search on Splunk search head ,hence looking for some addon that can help in field extraction. I hav tried installing few McAfee addons but they all seem to be for Mcafee ePO or Antivirus & IPS but none for McAfee DAM. ... View more

Our security events count is in millions and we observed that we have more then 600 service accounts in our environment and they contribute millions of events for a/c log on events and hence we want to drop these events for service accounts. Is there a regex available to drop service account events from active directory to be used on the universal forwarder? ... View more