Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About treven
treven
Explorer
Member since:
07-28-2023
Friday
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 07-28-2023 |
Activity Feed
- Posted Re: Splunk ES Adaptive Response | Custom Local Scripts using Dynamic Variables to query external APIs on Other Usage. Friday
- Posted Re: Read Only Executive Summary Splunk ES on Splunk Enterprise Security. Friday
- Karma Re: Read Only Executive Summary Splunk ES for TheLawsOfChaos. Friday
- Karma Re: Splunk ES - Configuration file settings may be duplicated in multiple apps for harsmarvania57. Friday
- Posted Re: Splunk ES - Configuration file settings may be duplicated in multiple apps on Reporting. Friday
- Posted Re: Is there a way to run a search with an adaptive response? on Splunk Enterprise Security. 03-27-2024 10:21 AM
- Posted Read Only Executive Summary Splunk ES on Splunk Enterprise Security. 02-21-2024 12:43 PM
- Tagged Splunk ES Adaptive Response | Custom Local Scripts using Dynamic Variables to query external APIs on Other Usage. 02-05-2024 12:49 PM
- Posted Splunk ES Adaptive Response | Custom Local Scripts using Dynamic Variables to query external APIs on Other Usage. 02-05-2024 12:15 PM
- Karma Re: Extracting Attachments for gcusello. 07-28-2023 11:57 AM
- Karma Re: Extracting Attachments for gcusello. 07-28-2023 11:57 AM
- Posted Re: Extracting Attachments on Splunk Search. 07-28-2023 08:34 AM
- Karma Re: Extracting Attachments for gcusello. 07-28-2023 08:34 AM
- Posted Re: Extracting Attachments on Splunk Search. 07-28-2023 08:32 AM
- Posted Re: Extracting Attachments on Splunk Search. 07-28-2023 08:05 AM
- Posted Re: Extracting Attachments on Splunk Search. 07-28-2023 06:57 AM
- Posted Re: Extracting Attachments on Splunk Search. 07-28-2023 06:52 AM
- Posted How can I extract attachments? on Splunk Search. 07-28-2023 06:27 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
Friday
@Albert_Cyber , Kind of, we are in the process of creating custom apps for these use cases and adaptive response actions. The only problem is it really is a pain to create a whole app to just make some very simple api calls and run basic commands like dig against a specified variable. We are following: Create an AR action | Documentation | Splunk Developer Program the guidance from these docs as there isn't much out there on it and I'm more of a bash scripter than a python programmer so it is a very slow process for us.
... View more
Friday
Sorry for the late response on this but this is exactly what we did created a user and role separate from the others exec_view and assigned that role read-only permissions and assigned it to specific users. Thanks for the information!
... View more
Friday
This exact scenario just happened in our environment as well and it turned out a savedsearch with the same name was under a different user. Thank you for providing this old but still applicable post!
... View more
03-27-2024
10:21 AM
This is a pretty old post but were you ever able to figure out a solution to this? I am currently exploring these options with a custom adaptive response. Thanks!
... View more
02-21-2024
12:43 PM
Is there a way to give a user read-only access to only a specific dashboard on Splunk ES such as the Executive Summary dashboard? Any assistance would be greatly appreciated! *Edit Sorry we have the user role and user created but we are unable to restrict it to a single dashboard, we can specify an app such as ES but have been unsuccessful in getting a default dashboard set. When you land on ES there is the "Security Posture" "Incident Review" "App Configuration" etc settings. Would it be possible to change one of these from "Security Posture" to "Executive Summary" so that way they are just a click away from the appropriate dashboard? Thank you!
... View more
Labels
- Labels:
-
configuration
-
other
02-05-2024
12:15 PM
Hey Everyone! We just started using Splunk ES, we just got it up and running fairly well and I have a couple questions hopefully I could get some guidance on or maybe a point in the right direction. I would like to somehow setup the ability for analyst to be able to run local scripts in the adaptive response that use dynamic user input as variables to query external APIs. Another scenario, I was hoping we could use, would be using specific tokens/fields as the dynamic variable for these scripts and just give the analyst the output in the adaptive response when they are ran. Are any of these scenarios possible with ES we have tried to find a way to do this but so far have not come up with any successful implementation. Is there any documentation on implementing something like this? Any help would be very much appreciated!
... View more
- Tags:
- splunkes
07-28-2023
08:34 AM
@gcusello , This worked really well! Thank you very much for your assistance!
... View more
07-28-2023
08:32 AM
@gcusello That did it! Thank you very much for your assistance with this!
... View more
07-28-2023
08:05 AM
So, I was able to get the field extractor to do both png and jpg but any other selected field results in an error. I suppose I could create separate fields and use eval to somewhat accomplish what I am looking for. Here are some examples: date=2023-07-28 time=09:00:22.791 device_id=10000 log_id=000123 type=spam subtype=default pri=information session_id="1138-7644" client_name="" client_ip="1.1.1.1" dst_ip="1.1.1.1" from="email" to="email" subject="TITLE" msg="Antispam identified spam URL: http://website.jpg" date=2023-07-28 time=08:51:25.640 device_id=02222 log_id=00023 type=virus subtype=sandbox pri=information from="" to="" client_name="" client_ip="" session_id="1000-0322" msg="File file.pdf has been sent to Sandbox"
... View more
07-28-2023
06:57 AM
Yeah absolutely, I will post it soon. Thanks for your assistance.
... View more
07-28-2023
06:52 AM
Yes that is correct I am just looking to monitor the various types of attachment types. As I stated in my post, the field extracting feature is only allowing one type of attachment. It will only extract .jpg fields and will ignore pdf or png. If I try to add another by selecting it in an event, I will get an error.
... View more
07-28-2023
06:27 AM
I am attempting to extract attachment fields from our email logs using regex. Attachments like .jpg, .png, pdf, etc. I have gone through the process of using the SPL field extracting feature however it usually results in only one attachment type being selected or another, if I try and select other attachment types the extraction fails. Any suggestions would be greatly appreciated. Thank you.
... View more
Labels
- Labels:
-
field extraction
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Friday
|
