About mark_wymer

mark_wymer · ‎04-13-2022

Thanks for getting back to me Tom. I've dropped you a PM in return. Cheers, Mark.

mark_wymer · ‎04-13-2022

Hi everyone, I just watched an excellent demo / tutorial ( https://my.phantom.us/video/78/ ) by someone called Ian Forrest. During the video ( at about 45 minutes ) he demo's an excellent Custom Function that looks in the cached SOAR internals for the cached results from previous executions of a specific app/action. He did mention that this was a 'work in progress' and I can't find this CF in Community Hub nor on Github anywhere. Does anyone know what the status of his Custom Function is? Cheers, Mark.

mark_wymer · ‎03-10-2022

Hi Tom, Thanks for getting back to me. I did think that it may be a tall ask but hey-ho 🙂 I'll raise a request as you suggested. Cheers, Mark

mark_wymer · ‎03-09-2022

Hi all, Does anyone know if it's possible to use Cyberark to rotate the Splunk SOAR admin account password? If it is, do you have any pointers to get this solution implemented? As always, any help is most gratefully received, Mark.

mark_wymer · ‎01-19-2022

Thanks Tom - perfect 😊

mark_wymer · ‎01-19-2022

Hi Tom, hope your well. Not 'spoken' for ages. So, if I understand.... Pass the ID data from the artifact into a custom code snippet to write the data to, effectively, a temporary file then use the Phantom Vault API to upload this into the container (can the temporary file be deleted then or is the 'upload' just a pointer to the physical location?) This can then be attached to the email. Mark.

mark_wymer · ‎01-19-2022

Hi all, Does anyone know if it's possible to create a file from a field in an artifact? Scenario: We have an alert in Splunk SIEM that sends various bits of, tabulated, info to SOAR. One of the fields is a comma delimited list of ID's - this could be 1 or several hundred This kicks off a playbook to process this info and email the info to the 'owner' The ID data must be added to the sent email as an attachment I'm aware of the option to add attachments from the file vault to an email from SOAR using the smtp app but...... How do we get the ID data from the field in the artifact into a file? Any help would be much appreciated. Cheers, Mark.

mark_wymer · ‎06-23-2021

Hi all, Is there a way to configure the Introspection Partition monitor to check other filesystems rather than just the hotwarm & cold FS's? We have a separate filesystem for our Frozen buckets with scripts to delete buckets over a certain number of days old. Mostly this works well in our cluster but, occasionally, these fill up and prevent the cold buckets from being rolled over. This, then causes other problems. I'd like to be able to monitor the frozen FS to try and predict / prevent a full FS before it happens. I would rather use the Introspection app if possible. Cheers, Mark.

mark_wymer · ‎08-27-2020

The solution that I found, and as mentioned by others in different scenarios, is that the Metrics Index has to be defined on the searchheads as well as the indexer cluster. This is unlike an event index which does not, necessarily, have to be defined on a searchheads. Once I added an indexes.conf for that index on the SH, everything worked fine.

mark_wymer · ‎08-27-2020

Hi, thanks for your response. I cut down the actual SPL for brevity but I do understand your point. Being new to Metrics indexes any pointers are always useful. i have, however, resolved my issue (posted separately).

mark_wymer · ‎08-26-2020

Hi all, I'm using the (excellent) TrackMe app which uses a Metrics Index. The index has been created on a Indexer Cluster and I've verified that it is actually there ( /opt/splunk/bin/splunk list index -datatype metric ). However, when I try and search the index using | mcollect split=t index="trackme_metrics" I get the following: "Error in 'mcollect' command: Must specify a valid metric index" This is the 1st and only metrics index on our cluster so I cannot verify that other metrics indexes work OK. Also, the only suggested resolution to this seems to be that I should put the metrics index on our searchhead cluster - but that makes no sense to me! Am I doing something wrong or is there some setting that I need to configure before I can use a metrics index? Many thanks, Mark.

mark_wymer · ‎02-11-2020

Thanks for the answer / confirmation Nick.

mark_wymer · ‎02-11-2020

Hi all, Our environment consists of, amongst other things, a multisite (3) clustered environment. Each site has three indexers making a total of nine indexers. We also have a replication factor of 3. On each indexer the hot/warm and cold buckets are on separate filesystems. On one of the indexers, the filesystem containing the cold buckets suffered a hard disk failure which has destroyed the entire FS. My question is: when the disk/filesystem is repaired, will Splunk automatically rebuild the cold buckets from the replications? If it does, will it do it when I start Splunk or is there some maintenance commands that I will need to issue? Many thanks, Mark.

Posts	20
Solutions	1
Karma Given	1
Karma Received	1
Member Since	‎03-08-2019

Online Status	Offline
Date Last Visited	‎09-01-2022 11:28 AM

SOAR Custom Function - check_cached_data- Does any...

Is it possible to use Cyberark to rotate the Splun...

SOAR - Create File from Artifacts

Splunk Phantom Remote Search Compatibility

Introspection - Monitor Additional Partitions

Trackme Status Message Not Clearing

Unable to access Metrics Indexes

Hard disk Failure on One Index in a Cluster

'Chargeback Analysis for Splunk' app for Splunk v8

TA-maclookup fails when "No Vendor Exists" for a M...

Re: SOAR Custom Function - check_cached_data

SOAR Custom Function - check_cached_data- Does any...

Re: Splunk SOAR Admin Password Rotation