Our organization has Splunk Security Essentials app and our end goal is to map the data source to the MITRE Framework The issue is that the live data which was added manually in the data inventory tab is not showing up in data source check. Please find the screenshot below.     I have added them manually when it was not auto detected. We made a custom entry assigning the index and source types.  But it failing to show the live data but the data actually exists Any leads on this would be helpful. ... View more

Hi Splunkers, We are trying to forward the events to Phantom via data model export function. When we click on save and preview, we are getting below error: File contains parsing errors: [line 2]: '\xef\xbb\xbf# Version 7.2.1\n' Is there any workaround on this issue? ... View more

Hi Splunkers, I just created a saved search and my agenda is to write the event to threat_activity index. To do this i need to enable "action.threat_activity" param to 1. But when i change the parameter to 1 and save it its not updating instead its showing as action.threat_activity=0. Is there a work around on this issue. The only thing i need is to write the saved search result to threat_activity. Kindly help ... View more

The lookup file was working fine for long time (2 months) and contained 1000+ entries However, after upgrading to 7.0.3, it's not working properly. When run , most of the time throwing me errors like unknown error The search job "1532509894.27177" was canceled remotely or expired. The search query when run will show that its parsing and after some time will endup with above error. index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [|inputlookup Disabled | fields user] | stats count by user When tried with lookup with lesser number of entries ( 40 entries) its working fine. But when the entries in the lookup go above 400+ , im getting the error. Before upgrade, I was able to get the results even when i run for all time range. Do we have any workaround on this issue. ... View more

HI Splunkers, When running a search with inputlookup command, I suddenly see the following error messages. This is popping up all the time when i use the inputlookup command. Below is the sample query used: index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [inputlookup Disabled | fields user ] | stats count by user Is there any workaround on this issue. ... View more

HI Splunkers, In our environment, We have couple of unwanted threat groups and threat category list populated in the drop downs present in the security intelligence threat activity. How to remove them. Please find the screenshot below for the reference Just wanted to remove "F" from the threat Group and "undefined" From the threat Category dropdowns. Also F group has threat feeds added to ip_intel lookup. How to flush data related to certain threat_key? Need your help ... View more

HI Splunkers, I'm using append command to combine the results of two datamodels over a period of a time but I'm unable to fetch complete results. When the query is run individually im getting complete results but that same results im not seeing when combined with append command. Do we have any workaround on this? Below is the query which im running on splunk | tstats allow_old_summaries=t count from datamodel=Palo_Url_Filtering where Palo_Url_Filtering.dest_hostname!="*explicit.bing.net" groupby _time Palo_Url_Filtering.client_ip Palo_Url_Filtering.dest_hostname Palo_Url_Filtering.category Palo_Url_Filtering.action |search [| inputlookup topDomainsfinal.csv | rename fqdn as Palo_Url_Filtering.dest_hostname | fields Palo_Url_Filtering.dest_hostname ] |stats count sum(count) as Total_request list(count) as Individual_domain_request_count list(_time) as time values(Palo_Url_Filtering.category) as Palo_Url_Filtering.category values(Palo_Url_Filtering.action) as Palo_Url_Filtering.action by Palo_Url_Filtering.client_ip Palo_Url_Filtering.dest_hostname | convert ctime(time) | rename Palo_Url_Filtering.dest_hostname as fqdn | lookup topDomainsfinal.csv fqdn as fqdn Output category vtratio | where Total_request >=2 | fields Palo_Url_Filtering.client_ip fqdn Total_request Individual_domain_request_count time Palo_Url_Filtering.category Palo_Url_Filtering.action category vtratio | append [| tstats allow_old_summaries=t count from datamodel=DNS_Internal where DNS_Query.domain!="*explicit.bing.net" groupby _time DNS_Query.src_ip DNS_Query.domain | search [| inputlookup topDomainsfinal.csv | rename fqdn as DNS_Query.domain | fields DNS_Query.domain ] |stats count sum(count) as Total_request list(count) as Individual_domain_request_count list(_time) as time values(category) as category by DNS_Query.src_ip DNS_Query.domain | convert ctime(time) | rename DNS_Query.domain as fqdn | lookup topDomainsfinal.csv fqdn as fqdn Output category vtratio | where Total_request >=2 | fields DNS_Query.src_ip fqdn Total_request Individual_domain_request_count time category vtratio] | ... View more

Hi Splunkers, Whats the best way to rename the existing correlation search.? ... View more

Hi Splunkers, I have a lookup which contains Suspicious UA String/Keyword and type. Please find below screenshot Also I do have a query to capture any event matching the suspicious keyword. sourcetype=iis OR sourcetype=pan:threat OR (index=citrix sourcetype=citrix:netscaler:syslog) | eval cs_User_Agent=coalesce(cs_User_Agent,user_agent,citrix_useragent) | stats count by _time sourcetype cs_User_Agent | search [| inputlookup Suspicious_Useragent_List.csv | eval search=""+cs_User_Agent+"" | rename search as cs_User_Agent |fields cs_User_Agent] | convert ctime(_time) | stats values(_time) as UA_Timestamp first(_time) as Earliest_UA_Timestamp last(_time) as Lastest_UA_Timestamp values(sourcetype) as UA_Sourcetype count by cs_User_Agent |rename cs_User_Agent as Non_Standard_User_Agent count as UA_Count | After running the query the output results will be like below screenshot: What i require is to display the matching word and type along with the results!!! Any help will be appreciated ... View more