Hello, Pls could you provide the integration steps for Kaspersky EDR Optimum and Kaspersky Sandbox with Splunk ... View more

Hi All,The following search has been created to identify the unsecure communications.Also i need to see the end-to-end connectivity if it’s successful on unsecure protocol. For example, some services are configured in F5 with HTTP redirection profile. Now ultimately you will observe port 80 traffic on Edge firewall but F5 then redirects it to HTTPS.so please could you help us to achive these? (index=paloalto OR index=juniper) (dest_port= 20 OR dest_port= 22 OR dest_port= 23 OR dest_port= 53 OR dest_port= 139 OR dest_port= 80 OR dest_port= 445 OR dest_port= 3389 OR dest_port= 21) | lookup Port_service.csv dest_port as dest_port OUTPUT service | stats count values(src_ip) by dest_port service dest_ip transport action  | table values(src_ip) dest_port service transport dest_ip count action ... View more

hi All,   Pls could you share any links or document's for firewall usecases.   Thanks in advance 🙂  ... View more

Hi,  Please could you help me to create the below use case in splunk.   1) User logged in having DBA privileges   2) Admin adding or removing Softwares/application on machines   3)email with malicious attachments 4)Social Engineering Attacks - Potential Phishing 5) Addition of new infrastructure in the network New VLAN creation 6) Detection of covert channels ... View more

Hi All, is any one created Use case to report on users who are accessing systems or data that is not within their regular usage? ... View more

Hi Team, I am getting below error in Splunk UI also i am not able to see new events in indexer since last 3 days. 04-08-2019 01:12:20.811 -0500 INFO PeriodicHealthReporter - feature="TCPOutAutoLB-0" color=yellow due_to_stanza="feature:s2s_autolb" due_to_indicator="s2s_connections" node_type=feature node_path=splunkd.data_forwarding.splunk-2-splunk_forwarding.tcpoutautolb-0 Note : Splund running fine. ... View more

Hello, Please could someone help me find out whether i am getting data from the universal forwarder to the heavy forwarder? Note : I don't have UF and Indexers, Search head CLI access. Thanks. ... View more

Hello Team, Recently i have created one report to send the data from _introspection index to summary index using collect command and i am able to see the data in summary index but how can i search the data as per below output from summary index? SPL command which we used to get the Indexer CPU utilization on one hour span : index="_introspection" host="xxxx*" component=hostwide |lookup indexers_lookup host OUTPUT alias | eval Pct_time=(100-'data.cpu_idle_pct') |eval Pct_time=round(Pct_time,2) | timechart span=1h avg(Pct_time) by alias limit=0 usenull=f SPL command which we used in report to send the above CPU utilization report to Summary index on every one hour base. index="_introspection" host="xxxx*" component=hostwide earliest=-1h@h latest=@h | lookup indexers_lookup host OUTPUT alias | eval cpu_time=round((100-'data.cpu_idle_pct'),2) | fillnull alias value=NONE | search alias != "NONE" | table _time,alias,cpu_time | rename host as "orig_host" cpu_time as "Percent CPU Busy" | collect index=summary addtime=true marker="search_name=\"Splunk Indexers CPU Busy Snapshot\"" run_in_preview=false Note : 1) I have created one cron job to send the report to _intersection index to summary on every one hour basis 2) Cron Expression : */17 */1 * * * 3) Time Range : Last One hour i am able to see the data after moving the data from intersepection to summary index so please could you some one help me to get the below output from summary index? index="_introspection" host="xxxx*" component=hostwide |lookup indexers_lookup host OUTPUT alias | eval Pct_time=(100-'data.cpu_idle_pct') |eval Pct_time=round(Pct_time,2) | timechart span=1h avg(Pct_time) by alias limit=0 usenull=f Thanks in advance!!! ... View more