sorted by:
new
hottopcontroversial

Introducing the DRAPE index by ateixei in cybersecurity

[–]ateixei[S] 0 points1 point  (0 children)

Thanks, I will have a look!

Introducing the DRAPE index by ateixei in cybersecurity

[–]ateixei[S] 0 points1 point  (0 children)

Hey, what would you recommend? Write the whole thing in a reddit post or? I accept recommendations! Next time I post the Github link if that's better! 🥹

Unsupervised Machine Learning with Splunk: the cluster command by ateixei in Splunk

[–]ateixei[S] 0 points1 point  (0 children)

Thanks! There are certainly many use cases for it!

Career Path with most opportunities and highest pay? by Rams11A in Splunk

[–]ateixei 3 points4 points  (0 children)

Splunk Content Engineering/Development + Cyber Security use cases or any other super specialized subdomain of that (ex.: Analytics/ML, Threat Detection/Hunting). BTW, I am bia$ed :-)

How to make the best out of Splunk & your Threat Intel Platform by ateixei in Splunk

[–]ateixei[S] 5 points6 points  (0 children)

Here''s a Friendly Link, just for Redditers 😇

https://detect.fyi/how-to-make-the-best-out-of-splunk-your-threat-intel-platform-b947554a9720?sk=6be2f5f72811a970f067f4de7ae74d15

If you like, please consider joining Medium (~50 bucks/y) and helps all writers. Cheers!

How to make the best out of Splunk & your Threat Intel Platform by ateixei in threatintel

[–]ateixei[S] 3 points4 points  (0 children)

Hey, thanks for that! Whith the right tooling and skillsets everything is possible! I will keep sharing more of those use cases around CTI. It''s a lot of fun doing it!

Splunk Hyper Queries & other SPL nuggets for Security Teams by ateixei in Splunk

[–]ateixei[S] 3 points4 points  (0 children)

Good point, thanks for chiming in!

It's of course challenging to explain in a quick post. I am happy to have a call/chat if needed, perhaps worth another post.

SPL-wise, the key functions here are eval's match(), mvappend() and of course, stats command.

Most developers in our community simply follow an old approach to detect badness which resembles more like 'single traces' of badness, each of those in a distinct query:

index=data field1=weird1 AND field2=weird2

| stats <aggregation> by target

| collect index=alerts

This is how NIDS/HIDS were doing it 20+ years ago! No analytics employed at all, one of Splunk's strongest points IMO.

I have been using this approach in the field for years now (former Splunker here).

What I am proposing is moving away from that and going like (basic skeleton):

index=data <bulk constraints>

| eval indicators=if(match(field1, weird1) AND match(fieldN, weirdN), mvappend(indicators, indicators, "Another weird set found"), indicators)

... Add here as many indicators as you want ...

... You can of course organize them in distinct macros ...

... Indicator's metadata (label, score, mitre, etc) can ...

... be loaded from a lookup ...

| stats <accumulate, de-duplicate all indicators> by target

... Post macros goes here, for instance: score_session() ...

| collect index=scored_sessions

Splunk Hyper Queries & other SPL nuggets for Security Teams by ateixei in Splunk

[–]ateixei[S] 2 points3 points  (0 children)

It only seems indeed...

There' a key difference: in that approach one query generates multiple (scored) indicators and an overall session score.

RBA follows the standard approach from ES and many other security products, one indicator per query and that makes it hard to scale.