Hey Splunkers,
Working on configuring Enterprise Security and need a hand with New Domain Analysis Dashboard. Here's whats up:
- Under "Domain Type" when I select
"Newly Seen" -- I see plenty of
results and all but the bottom panel
populate correctly.
- Under "Domain
Type" when I select "Newly
Registered" -- none of the panels
populate.
My hunch is that whatever mechanism that calls the "whois" doesn't work correctly. I went into "SA-NetworkProtection\bin" and chmoded all the python files to execute. Permissions look right.
The problem (I think) is that my ES search head has no internet access. Pretty sure I need to open up the mechanism that makes the whois work. Any advice on this? Documentation? Instructions?
As always, thanks in advance!
