It seems the github content for TA-microsoft-sysmon is available? Can you anyone know of anything about it? https://splunkbase.splunk.com/app/1914/#/details https://github.com/splunk/TA-microsoft-sysmon%29. ... View more

The Lookup cache has been generated with 90 days baseline before Search 2 in which "dest" field is not "null" for any user and the "dest" field is expected not to be "null" at anytime. then later, it is saved as report and scheduled to run every hour (Query 2). Search 1: index=x | stats count earliest(_time) as firstTime latest(_time) as lastTime last(dest) as new_dest by user | outputlookup test.csv Search 2: index=x | stats count earliest(_time) as firstTime latest(_time) as lastTime last(dest) as new_dest by user | inputlookup append=t test.csv | eval destination = coalesce(new_dest,dest) | stats min(firstTime) as firstTime, max(lastTime) as lastTime values(destination) as Destination by user | outputlookup test So the issue is, when it runs for last hour, the "dest" field in the lookup gets updated for users who were seen in last hour only and "dest" becomes null for rest of the users after appending. so the need is to retain the old "dest" values for users who have not seen in the last hour, but I don't see any issue with "_time" fields. ... View more

Hello All, We upgraded the TA for sysmon to support version 10 (precisely the latest version 10.41) this week. Actually TA for v10 is supported from June 2019. https://github.com/splunk/TA-microsoft-sysmon After the upgrade, we noticed inconsistency with field mapping. For instance, file_hash is unknown for file create events which basically indiates not compliant with Endpoint datamodel, etc. There was no issue with previous TA, worked well with sysmon v9 and fully compliant with Endpoint DM. Due to the issue with field mapping, All correlation Endpoint DM related correlation searches stopped working. Can someone help on this please? OR do I have to fix anything to make it work. Your early is very much appreciated. Thanks Splunk CIM is up-to-date with verison 4.14.0 https://splunkbase.splunk.com/app/1621/#/details Enterprise Security version Version: 5.3.1 ... View more

Hello, The add-on for MS sysmon developed by Dave Herrald has been tested for Sysmon version 8.0 as per the link, but now we have a new version 9.0. is it going to be tested and upgraded for new version? https://splunkbase.splunk.com/app/1914/ We have already upgraded sysmon to version 9 with new scheme 4.2 via sysmon TA with version 8.0.0, although the latest version of TA is 8.1.0 which has been tested only till sysmon 8.0. We observe that the fields are not normalized for CIM datamodel (Endpoint) because the new correlation searches from Enterprise Security are mostly based on Datamodel Endpoint. Thanks, ... View more

Hello, I have a two queries from two DM (Authentication and Change-Analysis). Task: Basically, I need to exclude the users who have changed the password themselves in the last 3 days for a brute force detection. I am having hardtime in merge two results from two DM's. The query which is using Authentication DM is grouped src and the other query which is using Change-analysis does not src fieled, but both have "user" field in common. How do I merge them? can we join these two queries using common field "user" or subsearch? The below is not the actual working. but it tells that I need to join the subsearch. Please let me know if you still need more clarication on this. Sample: | from datamodel:"Authentication"."Authentication" | search user!=[search index=oswinsec earliest=-72h@h latest=-1h@h tag=account ((EventCode=4723 status=success) OR (EventCode=4738 action=modified)) user!="$" | stats dc(EventCode) as count by user | where count=2 | table user] | stats count(eval('action'=="failure")) as failure,count(eval('action'=="success")) as success by src ... View more