Hi Splunk community, I am trying to determine the impact of removing Adobe Flash from our environment. I have done basic search and the results returned are much higher than expected. This would most probably be because staff are accessing external content as well as internally hosted. Is it possible to have a query that tells me which url has invoked flash player? I have tried: event_simpleName=ProcessRollup* FileName=FlashUtil*_ActiveX.exe and FileName=Flash*.ocx The query returns, hostname, timestamp of execution, username, and others but i don't get the dns requests or url that invoked flash player. So far to get around this I do another separate search (query) on the host, based on the timestamp (of the results of above query) looking up the dns request. Example result: Domainname: host: user: filename: commandline: ssl.gstatic.com computer123 user123 iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" https://docs.google.com/spreadsheets/z/xyz/edit?usp=drive_web Most DNS requests are within fraction of the second or +1 second. Finding a computer with useful data is a draw of the luck and very time consuming. Is anyone able to help with the above query? I am trying to have on query that gives me hostname, username, timestamp, app e.g. FlashUtil*_ActiveX.exe and dns request or url, or commandline. We use crowdstrike for end-point protection and the logs are feed to splunk by the crowdstrike agent.
... View more