All Apps and Add-ons

Seculert app for Splunk: How is the Summary lookup generated?

rgonzale6
Path Finder

There appears to be data in the Summary lookup file that's not in the raw data in the seculert_records index - at least not according to the timestamps in both.

How is this lookup generated?

0 Karma

doron_peri
New Member

Seculert detects malware communications from devices in your organization to command and control hosts.
The individual raw communication records are reported into Splunk as events, while the aggregate incidents of infected devices are reported in a Summary lookup.
Using lookup solves challenge of updating information in an incident entity such as the time it was last seen or its status (open, closed).
Records and incidents are linked through an incident id.

0 Karma

yannK
Splunk Employee
Splunk Employee
  • summary are populated by scheduled searched.

  • lookups are populated with scheduled searches, or by scripts.
    check for any search that contains "outputlookup"

0 Karma

rgonzale6
Path Finder

There are two scheduled saved searches for this app - neither is set to output to a summary index or an output file that populates this particular file.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...