I've been working to recreate a query in Splunk from Microsoft Defender Endpoint that shows what files users have copied to USB Drives. The query works like this: Step 1: Get all file USB Mount Events Step 2: Get all file creation events on drives that are not C.  Step 3: Join the above two datasources by Device ID.  Step 4: Match drive letters and make sure the USB Mount time is less than File Create time.  Here's Microsoft's query: Microsoft-365-Defender-Hunting-Queries/Exfiltration/Files copied to USB drives.md at master · microsoft/Microsoft-365-Defender-Hunting-Queries · GitHub In Splunk I get to step three and then I'm not able to filter values based on that. Below is my query so far. Any suggestions would be helpful.  index=atp category="AdvancedHunting-DeviceFileEvents" properties.InitiatingProcessAccountName!="system" properties.ActionType="FileCreated" properties.FolderPath!="C:\\*" properties.FolderPath!="\\*" | fields properties.ReportId, properties.DeviceId, properties.InitiatingProcessAccountDomain, properties.InitiatingProcessAccountName, properties.InitiatingProcessAccountUpn, properties.FileName, properties.FolderPath, properties.SHA256, properties.Timestamp, properties.SensitivityLabel, properties.IsAzureInfoProtectionApplied | rename properties.ReportId as ReportId, properties.DeviceId as DeviceId, properties.InitiatingProcessAccountDomain as InitiatingProcessAccountDomain, properties.InitiatingProcessAccountName as InitiatingProcessAccountName, properties.InitiatingProcessAccountUpn as InitiatingProcessAccountUpn, properties.FileName as FileName, properties.FolderPath as FolderPath, properties.SHA256 as SHA256, properties.Timestamp as Timestamp, properties.SensitivityLabel as SensitivityLabel, properties.IsAzureInfoProtectionApplied as IsAzureInfoProtectionApplied | eval Timestamp_epoch = strptime (Timestamp, "%Y-%m-%dT%H:%M:%S.%6N%Z") | sort DeviceId, Timestamp desc | join type=inner left=L right=R where L.DeviceId = R.DeviceId [search index=atp category="AdvancedHunting-DeviceEvents" properties.ActionType="UsbDriveMounted" | spath input=properties.AdditionalFields | fields properties.DeviceId, properties.DeviceName, DriveLetter, properties.Timestamp, ProductName, SerialNumber, Manufacturer | sort properties.DeviceId, properties.Timestamp desc | rename properties.DeviceId as DeviceId, properties.DeviceName as DeviceName, properties.Timestamp as MountTime | eval MountTime_epoch = strptime (MountTime, "%Y-%m-%dT%H:%M:%S.%6N%Z") ] | table L.FolderPath,R.DriveLetter, R.MountTime, R.MountTime_epoch, L.Timestamp, L.Timestamp_epoch       ... View more

I'm sending $phrase$ in an email notification but they don't make it through because Splunk assumes they are variables. Is there a way to send these without Splunk recognizing them as a variable?  Thanks ... View more

When I move to the latest version of the Okta App (2.25.x) knowledge bundle replication  breaks with the following errors: "Failed to untar the bundle="D:\Program Files\Splunk\var\run\searchpeers\<name>.bundle." Unable to distribute to peer named <indexer>at uri https://<indexer>:8089 because replication was unsuccessful. ReplicationStatus: Failed - Failure info: failed_because_BUNDLE_DATA_TRANSMIT_FAILURE I've noticed that prior to the installation knowledge bundle replication happened rather infrequently but after the install it's constant. My search bundles are all around 500MB.  Here's a couple of things I've tried I've tried increasing the bundle timeouts Checking for large lookup files in the Okta App -- they dont exist.  removing all knowledge bundle files on indexers and the search and letting them regenerate.  Completely removing the app from the searchhead and starting fresh.  When I remove the Okta app the error goes away. Okta and Splunk support have been little help so far.  Any suggestions on what could be causing this would be appreciated. Thanks.  ... View more

I'm using the Splunk Addon for Microsoft Cloud Service to import our ATP / Microsoft Defender Endpoint Data into Splunk. I've succeeded into getting the data in but the events aren't getting separated correctly. Below is a screenshot of a single event. Each Record should be an individual Splunk event.  My question is should the Splunk Addon for Microsoft Cloud Service automatically parse this out or is this something I should work through in the props.conf and linebreaks.    Here's the information I used to set this up:  ATP to EventHub: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub Event Hub to Splunk: https://www.splunk.com/en_us/blog/platform/splunking-azure-event-hubs.html     ... View more