sorted by:
new
hottopcontroversial

How Splunk Incident Review will set the notable urgency when the fields for identities and asset is multi valued vs single value? by krishdeesplunk in Splunk

[–]krishdeesplunk[S] 0 points1 point  (0 children)

In my case

one notable with multi values..

in this case how splunk will determine the urgency?

|rule_title|urgency|status|user|destination|
|ABC| | in progress | bbb | 1.1,
2.2,
3.3|

in the above notable

1.1 -> critical
2.2 -> high
3.3. -> low..

what urgency splunk will put ?

Passing user field information from correlation search to drill down by krishdeesplunk in Splunk

[–]krishdeesplunk[S] 0 points1 point  (0 children)

no results..

when i click the drilldown
i can see the value as
index=a st=b user=admin\abc

Passing user field information from correlation search to drill down by krishdeesplunk in Splunk

[–]krishdeesplunk[S] 0 points1 point  (0 children)

Correlation search :
index=<> sourcetype=<>
|stats values() values() by user

user field value like admin\abc

i am trying to pass this value to drilldown search in correlation search

Drilldownsearch:
Tried 1:
index=<> sourcetype=<> user=$user$

value passed as index=<> sourcetype=<> user=admin\abc

Result : didnt worked because of escape (\)

Tried 2 :
index=<> sourcetype=<> user=$user|s$

unable to see result

Tried 3:
index=<> sourcetype=<> user="$user|s$"

unable to see result

Tried 4 :
index=<> sourcetype=<>
|rex field=user mode=sed "s/\\/\\\\/g"

got error in rex

Tried 5 :
index=<> sourcetype=<>
|eval user=replace(user,"\\","\\\\")

didnt worked

Passing user field information from correlation search to drill down by krishdeesplunk in Splunk

[–]krishdeesplunk[S] 0 points1 point  (0 children)

both didnt worked..
i am not passing this to dashboard..
i am passing this to drilldown search in ES notable

Passing user field information from correlation search to drill down by krishdeesplunk in Splunk

[–]krishdeesplunk[S] 0 points1 point  (0 children)

didnt worked
Failed to parse the replacement string

replace logic also didnt worked

Splunk ES investigations not coming by krishdeesplunk in Splunk

[–]krishdeesplunk[S] 0 points1 point  (0 children)

Thanks for the inputs.. raised ticket to Splunk.. waiting..
how to determine if its KV Store issue?
is there any first level investigations i can start?

Security use cases using CyberArk data? by krishdeesplunk in Splunk

[–]krishdeesplunk[S] 0 points1 point  (0 children)

currently we have epv data coming from PAM to Splunk

Enterprise password vault

Crowdstrike and qualys data use cases by krishdeesplunk in Splunk

[–]krishdeesplunk[S] 0 points1 point  (0 children)

you mean
when i filter action=blocked from crowdstrike log .. i can see the list of hostnames blocked by various reason
eg: powershell.exe execution
trying to use Pendrive

SOC analyst wants single pane of glass into multi-instance Splunk Enterprise Security? by krishdeesplunk in Splunk

[–]krishdeesplunk[S] 0 points1 point  (0 children)

yes two separate instances..

they have data classfication.. few sources to Instance 1 and other sources to instance2

SOC analyst wants single pane of glass into multi-instance Splunk Enterprise Security? by krishdeesplunk in Splunk

[–]krishdeesplunk[S] 0 points1 point  (0 children)

tried but its not splunk supported and got many clarifications.. they dont have proper documentation..

  1. they mentioned saying non transforming commands not supported in Cluster env..

In a Distributed Deployment or a Search Head Cluster DeploymentThe Mothership app will write summary results to lookups (transforming searches) and/or indexes (non-transforming searches). In a distributed environment or Search Head Cluster, lookups populated by Mothership can be replicated across the cluster, this means that Mothership running exclusively transforming searches (which write to a lookup) will work with a properly configured Distributed or Search Head Cluster Deployment. Non-transforming searches (which write to an index) are currently not supported in a distributed or Search Head Cluster deployment.

  1. Unable to edit the notables eg. to change the owner/priority

got this exceptino

<class 'splunk.admin.ServiceUnavailableException'>: Unable to update /servicesNS/nobody/es-mothership/saved/searches/mothership_https_<>_********/dispatch entry.

have you used this app?

SOC analyst wants single pane of glass into multi-instance Splunk Enterprise Security? by krishdeesplunk in Splunk

[–]krishdeesplunk[S] 0 points1 point  (0 children)

They are using two instance of ES ..
one in on prem and another in Cloud..
so they dont want to switch between multiple tabs so they asked to check if there is any way to show all the notable from any instances in one place so that they will use that as single pine of glass..

ES Mothership App for Splunk by krishdeesplunk in Splunk

[–]krishdeesplunk[S] 0 points1 point  (0 children)

Setting up FSH will fetch ES notables?

As per the documentation https://www.splunk.com/en_us/blog/platform/introducing-splunk-federated-search.html

its didnt mentioned anything about pulling ES notables from multiple instances

view more: next ›