About kkkelvinkk

kkkelvinkk · ‎04-23-2017

Interesting. However, the following links seems report some different results. https://www.batchworks.de/why-using-xml-event-logs-sucks-using-splunk/ I will give a try tommorow.

kkkelvinkk · ‎04-13-2017

Below is the search query I extracted from Enterprise Security: | tstats allow_old_summaries=true count as change_count from datamodel=Change_Analysis.All_Changes by All_Changes.user,All_Changes.change_type | drop_dm_object_name("All_Changes") | xswhere change_count from change_count_by_user_by_change_type_1d in change_analysis by change_type is above high From my understanding, some data is search and then pipeline to "generating command". So, what is being passed as argument from the above search query ? I mean the pipeline being putting as the first character. Or it is just the correct syntax to use splunk ?

kkkelvinkk · ‎04-13-2017

Thanks. Is "configuration of suppression within correlation search" means selected the option "Create notable event" ?

kkkelvinkk · ‎04-12-2017

Hi all, I am now researching Splunk Enterprise Security. From my understanding, it is an app with some dashboard, which integrate some pre-defined correlation query, CIM and other App. I would like to know if correlation search is actually a "search query" that I can use to search for IoC (Inversion of Control)? Also, for the security posture dashboard, will it show all the correlation search that hits the condition? Let's say the enabled correlation search only has 5 results. Will these 5 results will all be shown in security posture dashboard? Thanks all.

kkkelvinkk · ‎04-12-2017

Hi all, I would like to ask what is the meaning of using pipeline as first character in search query. I saw some video tutorial that will use pipeline as first character and also correlation search in enterprise security. Thanks all.

kkkelvinkk · ‎04-07-2017

Thanks. I have installed the CIM, but CIM alone sms did not extract those fields. I also install Splunk Add-on for Unix and Linux and the fields are available now.

kkkelvinkk · ‎04-06-2017

Hi, I have installed a splunk enterprise trial and also requested Splunk Enterprise Security. I noticed that when I try a simple search "fail* password" in both platform, the fields that available are different. In Splunk Enterprise Security, the fields "dest, src, user" are being shown. I would like to ask is these fields are being known to splunk after installing Splunk Enterprise Security ? Thanks all.

Posts	7
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎04-29-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Splunk Enterprise Security: Can I use correlation ...

pipeline as first character in search query

Splunk Enterprise Security

Re: My Windows Event Log size increased dramatical...

Re: pipeline as first character in search query

Re: Splunk Enterprise Security: Can I use correlat...

Splunk Enterprise Security: Can I use correlation ...

pipeline as first character in search query

Re: Splunk Enterprise Security

Splunk Enterprise Security