Adding my 2c to this thread since I've found it be so very useful: 1. The ePO to splunk TLS connection requires only a splunk-side cert. I've used a self-signed cert by doing the following: 1.a.  sudo openssl req -x509 -days 3650 -nodes -newkey rsa:2048 -keyout splunk-epo-remote.key -out splunk-epo-remote.crt 1.b. cat  splunk-epo-remote.crt  splunk-epo-remote.key >  splunk-epo-remote.pem 2. the [SSL] stanza in input.conf is: serverCert=/opt/splunk/certs/ splunk-epo-remote.pem requireClientCert=false   I've also updated the ciperSuite based on this link https://community.splunk.com/t5/Getting-Data-In/how-to-configure-Mcafee-Epo-to-send-data-to-Splunk/m-p/532241 to add the AES256-GCM-SHA384 cipher     ... View more

Any changes made via the Web GUI or directly to the files should be as a *.conf files in the "Local" folder inside the app main folder.     ... View more

My pleasure. I'm glad I could do something to help someone today. ... View more

@JP ,   You should keep the '<<FIELD>>', this is the variable for the foreach loop (see the docs https://docs.splunk.com/Documentation/Splunk/8.2.1/SearchReference/Foreach) ... View more

@indeed_2000 , What system/app is generating this logs ? did you try to find a TA on Splunkbase for it ? At any rate, based on the logs you attached, this is what I came up with :   | rex "\-(?<id>\d+)\s*(\[|\_).*\-(?<id2>\d+)\s*(\[|\_)" | rex "(?<State>(Receive|Send|Received|Processed))(\s+Message|\:)" | transaction id startswith=(State=Received) endswith=(State=Send) ... View more

@indeed_2000 , what I wrote below is the complete SPL command assuming id and State are the correct fields just like you described. ... View more

Hi @cpmiv  Try use foreach : | makeresults 1 | eval Su=2 | eval M=2 | eval Tu=2 | eval W=2 | eval Th=2 | eval F=3 | eval Sa=3 | eval total=0 | foreach Su,M,Tu,W,Th,F,Sa [ eval total=total+<<FIELD>>] ... View more

Hi @splunkerer , With your permission I'll start from the beginning, with your problem statement. You wrote that "if login attempt get failed, userid doesn't show up" and "userid is supposed to be unique, but not always".  So how do you link between the failed login events and the following successful one ? by host name or some id ? If possible can you share some sample dataset from your dev/QA environment or something similar ?   ... View more

Hi @indeed_2000 , You can use the transaction command: transaction id startswith=(State=Received) endswith=(State=Send) The duration field will be created for you by the command.   ... View more

Hi @Lukas85 , Read the full set of column and use the function coalesce ( "This function takes an arbitrary number of arguments and returns the first value that is not NULL.") | makeresults 1 | eval column2=NULL,column3=NULL, column4=11223,column5=11559 | eval result= coalesce(column2,column3,column4,column5)     ... View more

| makeresults 1 | eval _raw="Server1234.prod.outlook.com/Microsoft Exchange Hosted Organizations/MyOrg.onmicrosoft.com/Smith, Joe" | rex mode=sed "s/.*\///g" | table _raw ... View more

Hi @JP , I hope I understood correctly what you are trying to do, if so maybe this will enable you to progress toward a solution (Working on the Win Events for demo sake) : index=main sourcetype=XmlWinEventLog | fields _raw | spath | foreach Event.System.* [ eval new_field=mvappend(new_field,'<<FIELD>>')] | table new_field | mvexpand new_field ... View more

Hi @splunkeradmin22 , Have a look at the below macro: |`incident_review` ... View more

Hi @itssuresh07 ,   I assume that when you run the first part of the query you do get the 4624 and 4688 Events, right ? If so, it might be that the maxspan or maxpause options were changed to very small defaults (like 1s). Try to explicitly declare no limits: | transaction Logon_ID host startswith=(EventCode=4624) endswith=(EventCode=4688) maxspan=-1 maxpause=-1   See the docs at https://docs.splunk.com/Documentation/Splunk/8.2.1/SearchReference/Transaction  ... View more

Hi @securitypaul , I would try to create time based lookup from the other two indexes and then define the automatic lookup to populate the relevant Data Model fields. https://docs.splunk.com/Documentation/Splunk/8.2.1/Knowledge/Configureatime-boundedlookup.       ... View more

Technically if you made changes only in the Local directory of the apps you should be safe to just upgrade the apps, but it wouldn't hurt to backup anyway. ... View more

You're welcome ! ... View more

Hi @Nurcan    You will have wrap the rules you have developed inside an Analytic Story for it to be displayed in ESCU. Go to Configure->Content Management-> Create New Content and choose Analytic Story. The mapping to Cyber Kill Chain and MITER ATTACK Framework will be derived by the annotations you created for the Correlation Search.   ... View more

Hi @kronite13 , You don't necessarily need to end up with 3,000 regexes but I think you will have to have some kind of reference to the exposed api endpoint that you then need to import, possibly into a multivalue field and check for the similarity in order to do the grouping you wish to do.   Hope this help. ... View more