Hello Splunk Community, I have .evtx files from several devices, and I would like to analyze them using Splunk Universal Forwarder (the agent). I want to set up the agent to continuously monitor these files as if the data is live, so that I can apply Splunk Enterprise Security (ES) rules to them. ... View more

Hello everyone, I hope you’re doing well. I need assistance with integrating Splunk with Elasticsearch. My goal is to pull data from Elasticsearch and send it to Splunk for analysis. I have a few questions on how to achieve this effectively: 1. **Integration Methods:** Are there recommended methods for integrating Splunk with Elasticsearch? 2. **Tools and Add-ons:** What tools or add-ons can be used to facilitate this integration? 3. **Setup and Configuration:** Are there specific steps or guidelines to follow for setting up this integration correctly? 4. **Examples and Guidance:** Could you provide any examples or guidance on how to configure Splunk to pull data from Elasticsearch? Any help or useful resources would be greatly appreciated. Thank you in advance for your time and assistance!     ... View more

Peace be upon you. I am now running correlation searches and I do not have data to fully test them. I want to activate them in order to protect the company from any attack. I have MITRE ATT&CK Compliance Security Content But I do not know where to start and how to arrange myself I hope for advice ... View more

Scenario: The device has been compromised, and we want to understand how the breach occurred. We have extracted data from the device from the Setup, Security, and Application logs in CSV format and uploaded it to Splunk. Question: What is the best way to automatically analyze this data in Splunk and identify any suspicious information ... View more

Hello everyone I want help on how to deal with the following problem A company that got hacked and we want to know how the hack happened and is there a data leak or not The company does not use any of the EDR and sime and ndr systems Question The best way to extract logs from the company's systems and analyze them in splunk and what are the rules to start searching ... View more

While using Splunk ES, we noticed that correlation searches were set To an incorrect security field on the Incident Review page. This leads to inaccurate classifications of events Security and affects the decision-making process The first step is to set security Domain = Access The problem is that instead of being classified as security Domain = Access, it is classified as Theret, and so all cases are classified as Theret This causes us a problem with the values ​​not appearing on the Security Posture page   ... View more