About logginz85

logginz85 · ‎07-04-2023

I realise this is possible sacrilegious, but here goes. We're looking to move all our Splunk stuff over to Google Chronicle. We used an app on Splunk cloud that is no longer supported, so this needs to be done as quickly as possible. Eventually we will replace the Splunk forwarders with an agnostic solution, but until then I figure we might just be able to use the current heavy forwarder and direct it to the Chronicle instance. Is it as simple as this sounds, or am I really oversimplifying?

logginz85 · ‎05-20-2021

Hi all. We currently use Alert manager to annotate apps, and for several of them we have a drilldown that inputlookups a lookup table, edits it, then outputlookup it after. This means the team can use drilldowns to verify activity from users or suppress notifications for example. Due to a small (but inevitable) incident where a lookup table was erased, we are now looking to utilise the Lookup Editor app so as to have some sort of version control. However looking at it, it seems that version control is only maintained if the table is edited in the Lookup Editor app itself? Does this mean that drilldowns will not cause a backup to be made, and instead we'll have to have a link to this table in the app instead? If so thats fine, but can values from an alert be parsed through to edit fields already? Or would any modifications to the tables have to be copy/pasted? Thanks in advance

logginz85 · ‎04-15-2021

Hi all. This rule has been driving me crazy for a while now, and the teams working on it too. Just looking for a way to track standard commands for user and/or group modifications. I tried using the built in syslog keys [index="*" (sourcetype="syslog" (key=user_modification OR key=group_modification OR key=etcgroup OR key=etcpasswd)] and while this works, it throws up so many false positives such as users whose password is changed by CyberArc. Has anyone had a similar issue and how did you best fix/monitor it?

logginz85 · ‎02-12-2021

I've got it. The idea was to have the username field auto-populated and to be read only so as to keep a record of which user submitted the item on the form. I thought of having it as a box that would read the $env:user$ field, then pulling that to a table to be displayed underneath, The issue was that if the username field pulls $env:user$, the user could simply edit that field to another users details. Got round it by instead of pulling to the form box, then going to table, just pulling straight to table. Thank you greatly for your help. That really helped.

logginz85 · ‎02-12-2021

that a fair point, I'd like the field to be used to capture whoever submitted the option in the form, but it doesnt need to be displayed I guess. As such, if I just hid the field but retained all the features, it would capture the env:user information but then not leave it open to be edited

logginz85 · ‎02-12-2021

That's amazing, so simple. Now how can I set it so that field cant be changed by the user too?

logginz85 · ‎02-12-2021

Hi All, I've got a form being built in Splunk Enterprise, its used as a lookup table so we can see if there is a known issue with a host etc... I use the issue field to have a drop down option, and the host and IP are manually input. What I'd like is for the "added by" field to be automatically populated with the signed in users ID/name/Username etc...This is for audit purposes mainly. I've looked around and can't seem to find out how to do this. Any/all help is greatly appreciated.

logginz85 · ‎12-07-2020

Hi there, I'm pretty new to Splunk, but have got a fortigate set up to send all logs to Splunk. Simply looking to find all attacks that Fortigate identifies that are successful. Fortigate is being managed by another team. I've got index = "*" AND tag = "attack" AND action = "allowed", but that seems to be way too simple. Or am I hugely overthinking this?

logginz85 · ‎11-16-2020

Hi, that makes sense, and |format helped me realise it wasn't pulling through right. That lead me onto this. index="*" host = * | eval standbyhost = "198.0.0.2" | rex field=standbyhost "(?<Net>\d+\.\d+\.\d+)\.(?<Host>\d+)" | eval Host2 = (Host-1) | eval newhost= Net. "." .Host2 | where host = newhost I create a new field "standbyhost" that is the value of the standby host I already know. I apply this to all results. Then I do maths to lower this IP by 1, and create the new field newhost. Now every rsult has their host as their own host IP, but the field newvalue of the target I'm looking for. Then its just a where host=newhost to find it. Seeing as this will actually pull the value of standbyhost from a field in an alert, I think this'll work.

logginz85 · ‎11-16-2020

Hi. I have an alert that'll tell me if a host is down, and it runs for both Active and Standby hosts. The issue is that when the standby host hasn't received a log, I'd like to run a search to see if the active host has received a log in the last 24 hours, and if so to ignore it. I can run a search for all IPs, but what I cant seem to do is see if 198.0.0.2 is down, to check for 198.0.0.1 (the Active is always -1 from Standby) I thought something like this might work, but no. index=* host=* [search index="*" host=198.0.0.2 |rex field=host "(?<Net>\d+\.\d+\.\d+)\.(?<Host>\d+)" |eval Host2 = (Host-1) |eval newhost= Net. "." .Host2 |fields newhost] |where host=newhost any and all help appreciated

logginz85 · ‎10-15-2020

looking just to suppress/auto-resolve on the main Alert manager page (Incident Posture?) I'm unsure how I'd go about modifying macros tbh.

logginz85 · ‎10-14-2020

Hi. We've recently started using Alert Manager on Splunk Cloud (8.1.2) and have managed to create dynamic alerts based upon a lookup of impact and urgency. These calculate the "priority" field in Alert Manager, and we're looking for a way to suppress the "informational" level alerts (low/low) Under Settings> Suppression Rules, I figured I could set up a rule that went as such, Rule type = Normal Scope = Rule_name* Field = $priority$ Condition = is Value = informational Yet this does not seem to suppress anything. I have tried with Field = $result.priority$ but that doesnt work either. Any help would be greatly appreciated

Posts	12
Solutions	1
Karma Given	3
Karma Received	2
Member Since	‎10-14-2020

Online Status	Offline
Date Last Visited	‎07-04-2023 07:10 AM

Send splunk forwarder to Google Chronicle

Lookup Editor and Alert Manager

Changes to user or group privileges

Autopopulate username field in a form

Simple attacks detected by Fortigate

Search for an adjacent IP address

Suppressing using priority field in Alert Manager

Send splunk forwarder to Google Chronicle

Lookup Editor and Alert Manager

Changes to user or group privileges

Re: Autopopulate username field in a form

Re: Autopopulate username field in a form

Re: Autopopulate username field in a form

Autopopulate username field in a form

Simple attacks detected by Fortigate

Re: Search for an adjacent IP address

Search for an adjacent IP address

Re: Suppressing using priority field in Alert Mana...

Suppressing using priority field in Alert Manager