Hi, I have a alert scheduled to monitor, if 2 different users who are accessing same device for authentication from okta and I'm monitoring it for 1 month. Once the alert is triggered , the same users details should not trigger for next 1 month. Any suggestions how can I achieve this ? ( Can be in query / alert actions ) Below is sample query: index=okta result=success NOT ( device=null) | eval _time=strftime(_time) | stats values (user ) as user dc(user) as "number of users per device" by device _time | lookup XXX | search "number of users per device">1 | regex device =myregx| rex field=user (myregex) | where isnull(match) | table fileds  | stats fields X y Z dc(_time) as detected by device | where detected>=1 | sort _time ... View more

Hi Team,  I have 2 indexes with same data. In Index1 data is coming with the fields user, action, http_referrer and  In index 2 data is coming with the fields loginid, action, referrer I want to table the results with common field data from 2 indexes like | table user, action, referrer  I tried using eval mvappend it didn't work. Can some one please assist. Thank You.  ... View more

Hi Team, I downloaded a file from webex app. But in crowdstrike while validating file name is showing. But the path and location where it's downloaded is not showing. Even in splunk proxy / crowdstrike indexes file name / any details it is not showing with the IP address of mine. Is there any way we can write use case to capture the details of files downloaded from webex app ? Thank you in advance.  ... View more

Team Can you please provide me documentation link to learn Splunk UBA platform and related links for monitoring, developing, architecture and installation, etc.,  Thank You.  ... View more

How to integrate / connect macro to data model or CIM data model  ... View more

Hi Team, If  I have to write CIM Data Model use cases for Malware / Authentication, etc., what are the Rules / Logic have to follow initially. If there is any documentation / source can you please provide me the link. Thank You. ... View more

I'm searching for list of indexes using |tstats count where index=* sourcetype=log4j  by index sourcetype I got results with lot of indexes in my environment. How can I find out which Data model / Macro using these indexes ? Is there any way to find out where it's been using ? Thanks in advance.   ... View more

Hi can some one help me with 'infection_found" tag is belongs to which Data Model.  Can it be consider for Malware data model - infection_found tag Malware attack ? If not, What can be the possible cases ?  Thank You !!  ... View more

I have raw event like : time action severity host , etc.,  But when I checked interesting filed action filed is not showing. All the logs are related to  mcafee getting from tcp:9997 Can some one please let me know what can be the issue and what actions can I take to correct this ? ... View more