About quangnm21

quangnm21 · ‎01-16-2024

It did not work correctly

quangnm21 · ‎01-16-2024

I want to combine these two events. Can anyone help me? I have tried using the join and append commands, but haven't been successful. I want to analyze data in the 'Endpoint' model to capture information related to 'mmc' and then compare the 'ID' to retrieve IP and port information from the 'Network' model.

quangnm21 · ‎12-27-2023

@dtburrows3 ,Thank you very much; the knowledge is truly helpful.

quangnm21 · ‎12-27-2023

Hi, @dtburrows3 I'm still having trouble understanding this query. My goal is to retrieve the file_path field in the event and compare it with a lookup file containing files that should not be deleted. If the file_path in my event matches a file in the lookup file, then the alert should be triggered. Similar to blacklisting malicious IP addresses.

quangnm21 · ‎12-27-2023

Hello everyone, I'm a beginner in using Splunk. I'm facing an issue in finding a search solution for the following idea: I'm logging the deletion behavior of files, and I have whitelisted some important files in a lookup. If the file_path in the event matches any of the file_paths in my lookup file, then it should produce a result. Here is the initial search, and it found 2 file_paths. This is my lookup file. Here is my search, but it's not working correctly. Thank you, everyone, for reading!

quangnm21 · ‎12-21-2023

@gcusello , Thank you

quangnm21 · ‎12-20-2023

This was my initial search. I cannot compare the two fields "srcdomain = destdomain" because when I intend to use eval my value is output as null. Thanks everyone

quangnm21 · ‎10-07-2023

Thank you very much for this suggestion.

quangnm21 · ‎10-06-2023

Hello everyone. I'm currently working on a lab assignment and I'm having trouble understanding the meaning of two specific fields in PowerShell log hunting. Could someone please explain these two fields to me? I would greatly appreciate it. Thank you.

Posts	10
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎10-06-2023

Online Status	Offline
Date Last Visited	‎01-19-2024 10:54 PM

How to combine two datamodels in the tstats comman...

Compare fields without wildcards

Splunk content

Analyzing PowerShell logs in Splunk

Re: How to combine two datamodels in the tstats co...

How to combine two datamodels in the tstats comman...

Re: Compare fields without wildcards

Re: Compare fields without wildcards

Compare fields without wildcards

Re: Splunk content

Splunk content

Re: Analyzing PowerShell logs in Splunk

Analyzing PowerShell logs in Splunk