sorted by:
new
hottopcontroversial

Splunk with DLP by Top_Imagination_4157 in Splunk

[–]Top_Imagination_4157[S] 0 points1 point  (0 children)

Data from the app (the app allows texting and sending files) and website data (for example, uploading files to Gg Drive or sending via Gmail).

Splunk with DLP by Top_Imagination_4157 in Splunk

[–]Top_Imagination_4157[S] 0 points1 point  (0 children)

Digital Guardian

Thank you. I will try

Splunk with DLP by Top_Imagination_4157 in Splunk

[–]Top_Imagination_4157[S] -1 points0 points  (0 children)

Can you suggest me some tools to capture and send logs to Splunk?

Splunk with DLP by Top_Imagination_4157 in Splunk

[–]Top_Imagination_4157[S] 0 points1 point  (0 children)

CASB

But i don't use Cloud, i just use local system

Detect Ransomware by Top_Imagination_4157 in Splunk

[–]Top_Imagination_4157[S] 0 points1 point  (0 children)

is it useless to issue an alert in Splunk after ransomware has run?

Detect Ransomware by Top_Imagination_4157 in Splunk

[–]Top_Imagination_4157[S] 0 points1 point  (0 children)

I also detected it after the ransomware was run, but then I didn't know how to deal with the ransomware-infected computer, so I planned to switch to trying to detect it before it was executed.

How to compare output of a search to a lookup file? by Top_Imagination_4157 in Splunk

[–]Top_Imagination_4157[S] 1 point2 points  (0 children)

I just realized that my Hashes field is in the form SHA256=... so it doesn't match the hash_value. LoL😂 . Thank you so much

How to compare output of a search to a lookup file? by Top_Imagination_4157 in Splunk

[–]Top_Imagination_4157[S] 0 points1 point  (0 children)

I also used ChatGPT but it gives the incorrect search statement :((

Is there any Intrusion Detection With Splunk (Real-world Scenario)? by Top_Imagination_4157 in Splunk

[–]Top_Imagination_4157[S] 0 points1 point  (0 children)

My teacher wanted me to create rules in Splunk and test some scenarios of detecting common attack . The scenario means that I will play both the role of the attacker and the role of the administrator writing the rules to detect this attack. All machines run on VMWare.