About a_n

a_n · ‎09-10-2021

Thank you sir!

a_n · ‎09-10-2021

Hello , search is like: index=FW |stats count by Src,Dst,sni results are like: 192.168.1.12 2.23.259.24 assets.msn.com 192.168.1.20 3.68.77.130 in the second row, the sni is empty. using a workflow, I can get the info of this IP (Amazon Technologies) but I have 2 issues: 1- I just need to get back single field (for example: Organization) 2- I want to be able to have this field (result of the workflow OR kind of External web lookup!) available in my reports and search results, like an extracted field. Thank you in advance for your kind support.

a_n · ‎09-10-2021

Hi, Sorry, I am afraid I did not get what is this? would you please elaborate? Thank you

a_n · ‎09-10-2021

Hi, I have a firewall log in which some of the destinations do not have SNI, but I have their IPs. I want to create/extract a new field from destination to get the destination details, for example the Resolve Host or the Organization. Can someone please advise if this is possible and how? Thank you in advance.

a_n · ‎09-10-2021

Yes, I was using this stats command. My concern is about the chart, so it seems this is the only way: to not attach PDF and include the Table inline. Thank you very much

a_n · ‎09-09-2021

I have added the search and chart, but seems in wrong level. Please check. Thank you

a_n · ‎09-09-2021

Hi, search is like: index=FW |table Src,Dst,pt |dedup Src,Dst,pt |rename Src as "Source",Dst as "Destination", pt as "Port" chart is like: Which I do not need it. I managed for now as a workaround to Not attache PDF and use Inline Table. Is it the only way to do this? Thank you

a_n · ‎09-09-2021

Any one can assist please?

a_n · ‎09-07-2021

Hello All, I have several alerts which send email notifications. I know it might be very basic, but I need your help. One alert is to specify if a local host has accessed a blacklisted IP. So I expect to have a table with: Src, Dest, Port The search returns table, but I do not understand why does it attach a Line-Chart diagram! I want it as Static table. In Visualization tab, it does not show me static table. I even tried to create a new alert without even going to the visualization tab, but I got same result. I have even changed the search and used Table instead of stats. Please advise. Thank you

a_n · ‎07-15-2021

@gcusello Appreciate your support ad assistance. Thank you

a_n · ‎07-15-2021

@gcusello Appreciate your advices. When I try sourcetype=WinHostMon Type=Application I do not have data back. when I run Get-WmiObject -Class Win32_Product * in powershell it gets data , but nothing on install date. I tried to modify the inputs.conf and add: [WinHostMon://application] type = application interval = 60 but no data ingested. Unfortunately I got lost with the scripting method. Isn't it possible just to modify the inputs.conf? Thank you again.

a_n · ‎07-15-2021

Hello @gcusello , Thank you, I have Windows TA but in the config I have [WinEventLog://Application], would you please advise about Discovery? and how to enable/use it? Or a reference please? Appreciate your advise. Thank you

a_n · ‎07-15-2021

Thank you, It works, however I am still worried that I may lose some events. Thank you very much for your help.

a_n · ‎07-14-2021

Ah, yes. Now I got your point regarding the time. I will handle it, thank you. Back to main issue: - I have one indexer only. - I compared 2 problematic events. the only differences are: Logon ID: (0x32E964BA , 0x32E964D4) Source Port: (54833,54835) What is the solution? How to ignore these? Thank you again

a_n · ‎07-14-2021

Dear @ITWhisperer Thank you for your response. As for the where clause, I agree. date_hour does not hold the data, hour field is ok. we need to now about working in forbidden hours, which is after 11 PM until 6 AM. The result I have has same hostname, same event code 4624. This is main search I have with results attached: index=main source="WinEventLog:Security" EventCode="4624" OR EventCode="539" OR (EventCode="529" AND EventCode="537") OR (EventCode="547" AND EventCode="549") |where (Logon_Type!=3 OR ( NOT LIKE(host,"DC%"))) AND Logon_Type!=9 | eval Signed_Account=mvindex (Account_Name,1) |eval hour=strftime(_time,"%H") |regex Signed_Account!="\$" | search Signed_Account=* Signed_Account!="SYSTEM" Signed_Account!="ANONYMOUS LOGON" Signed_Account!="Administrator" (hour>23 OR hour<6) | table host,Signed_Account,EventCode,_time

a_n · ‎07-14-2021

Hi. I have Splunk on windows network, and collecting data using UF from clients. I need to make a report for newly installed application on clients. I am searching for event id 11707 and also 1033, but it seems these event are being logged only if we use Windows Installer. For example, we installed Notepad++ on a client, and we do not have any event for that. Can someone please advise? Thank you.

a_n · ‎07-14-2021

Hello, Anyone can advise? Thank you.

a_n · ‎07-14-2021

Hi, I have Splunk on Windows network, and using UF for windows events. I am searching to detect users logon during specific hours: index=main source="WinEventLog:Security"EventCode=528 OR EventCode=540 OR EventCode=4624 |where Logon_Type!=3 OR (Logon_Type=3 AND NOT LIKE(host,"DC%")) | eval Signed_Account=mvindex (Account_Name,1) |eval hour=strftime(_time,"%H") | eval ShowTime=strftime(_time,"%D %H:%M") | search Signed_Account=TThemistokleous (hour>23 OR hour<6) | table host ShowTime Logon_Type Issue is, in result, I have for Same HOST, on Same TIME, 2 users signed on. AND Each signed on 4 times! Can someone please advise, what can be the issue? Thank you

a_n · ‎06-25-2021

Thank you, With some minor modifications, it worked. Appreciates.

a_n · ‎06-25-2021

Hello, I am ingesting files containing host and ports for each host. For each Source (FILE) The Nodes(host) and ports are being extracted and since I have many ports per node I have data as: FILE #1, NodeX, Port: 443/tcp, 80/tcp,21/tcp (and more...) -->using mvexpand for FILE#1 I have: Node, Port X, 443 X, 80 X,21 -->for FILE#2 I have the same --> for file #3, I have: X, 443 X, 80 (one port is missing, or in other scenarios added) so the count for Node X per FILE will be FILE, Count File#1, 3 File#2, 3 File#3, 2 I want to grab when there is a change in that count and raise an alert. I managed to show it on chart, but as I have many nodes, the chart is not suitable. Can any one advise the best way to grab this variance and set the alert? Thank you.

a_n · ‎06-04-2021

Hello, I have a dashboard with Choropleth map presenting events from various countries (categorical Color mode). In the legend, I see colors with the count of events. How can edit the legend in a way that the name of each country is also written along with count? Is it possible? Is there any other visualization doing this? Thank you in advanced for your advices.

a_n · ‎06-04-2021

Hello, I am checking a firewall log (Watchguard firebox) to monitor the network traffic for a windows LAN. I need to filter out the network load related to Windows Updates. The watchguard fields do not have sni in all records (sometime I have sni=download.microsoft.com, but sometimes sni is empty but destination IP is always available) Is there a list of the IPs used for windows update? ( I did not manage to find it) Is there another way to segregate the windows update traffic from other traffics? Appreciate if you share your ideas. Thank you.

a_n · ‎03-31-2021

Hi, I am ingesting Watchguard firebox events into my Splunk Enterprise but I just get the firewall traffic logs, I need to have its internal logs to check its health etc. Has anyone an idea and can advise how can I ingest the watchguard firebox internal logs to my splunk instance? Thank you in advance.

a_n · ‎03-30-2021

Hi there, First of all, I am not a professional splunker but due to my case, I have to dig deep for some scenarios on the watchguard firebox devices. Please note that, based on my experience so far on watchguard (again I am not guru) the app and add-on does not handle the fields extraction properly. I just used them so far for the source type (watchguard:firebox:syslog) and I am extracting most of the fields on my own. Please advise which fields do you need them the most, maybe we can help each other. I am using this regular expression for for Source_IP, Destination_IP, Source_Port and Destination_Port: (?<src_ip>\d+\.\d+\.\d+\.\d+) (?<dst_ip>\d+\.\d+\.\d+\.\d+) (?<src_portt>\d+) (?<dst_port>\d+) So far it covers all my needs for the required searches/dashboards. (do not forget the SPACES) Please advise if it helps you. Regards,

a_n · ‎03-25-2021

@gcusello Thank you

Posts	31
Solutions	0
Karma Given	10
Karma Received	0
Member Since	‎04-24-2019

Online Status	Offline
Date Last Visited	‎05-30-2022 01:36 PM

Adding a field from workflow

Alerts, wrong visualization in the attachment

How to catch is an Application Installed

Several user logon event for same host

How to Grab Variance

Customize Choropleth Map legend

Network traffic for Windows Update (Firewall logs)

How to get the watchguard internal logs?

Field Extraction (rex maybe?)

Entity stays Active even when the OS is powered of...

Re: Adding a field from workflow

Re: Adding a field from workflow

Re: Alerts, wrong visualization in the attachment

Adding a field from workflow

Re: Alerts, wrong visualization in the attachment

Re: Alerts, wrong visualization in the attachment

Re: Alerts, wrong visualization in the attachment

Re: Alerts, wrong visualization in the attachment

Alerts, wrong visualization in the attachment

Re: How to catch is an Application Installed

Re: How to catch is an Application Installed

Re: How to catch is an Application Installed

Re: Several user logon event for same host

Re: Several user logon event for same host

Re: Several user logon event for same host

How to catch is an Application Installed

Re: Network traffic for Windows Update (Firewall l...

Several user logon event for same host

Re: How to Grab Variance

How to Grab Variance

Customize Choropleth Map legend

Network traffic for Windows Update (Firewall logs)

How to get the watchguard internal logs?

Re: WatchGuard FireBox Assistance

Re: Field Extraction (rex maybe?)