see my answer here: https://community.splunk.com/t5/Splunk-Enterprise-Security/threat-intelligence/m-p/673449#M11868  ... View more

Should I expect that the threat intelligence that is streaming in is being ran against the events in my environment automatically?  I would not expect that, most vendors don't intergrade with the Splunk ES threat intel framework they just make the TI data available in Splunk via a lookup file or by putting it in a index. If you want to be sure the TI info is flowing into the threat intel framework I suggest you add the data there either by revering to the app created lookup (if any), by creating your own lookup from the indexed data or by adding a TAXII/STIX feed. See for more info: Splunk Latern  Splunk Docs   ... View more

if you are interested in the DM % complete over time you can create a search to get that data from the REST API endpoint and store it in a lookup I have done it like this: Search to get the info from the API endpoint (runs every 5 min): | rest /services/admin/summarization by_tstats=t splunk_server=local count=0 | eval datamodel=replace('summary.id',"DM_",""), datamodel=replace(datamodel,'eai:acl.app'."_",'eai:acl.app'."/"), _time=now(), complete='summary.complete'*100 | table _time datamodel complete | outputlookup dm_complete_info.csv append=t Search to cleanup data older than 14 days from the lookup table (runs every day at midnight): | inputlookup dm_complete_info.csv | eval oldest=now()-(14*86400) | where _time>oldest | table _time datamodel complete | outputlookup dm_complete_info.csv Search to make a graph of the data: | inputlookup dm_complete_info.csv | where _time>now()-(86400*7) | chart values(complete) AS complete over _time by datamodel useother=f usenull=f limit=0 ... View more

The eventtype "err0r" from the Splunk_SA_CIM is a very broad search.. that is almost a catch all ... View more

If the number changes than the message is not the same. That is why you still see both messages. What you can do is a replace, to remove the number and than do the dedup. something like this based on the layout of the message field you provided: | eval message=replace(message, "([^\d]*)(\d*\s*\d*\s*\d*)(.*)","\1\3") ... View more

This is not the same, and can cause other problems "down stream". If for example you use that alias field in a EVAL you can not do that anymore. The below (super simplified) example will not work anymore: _raw data1: "2018-12-06 15:54:00 Account_Name=arnold sid=123 message=bla" _raw data2: "2018-12-06 15:54:00 user=arnold sid=123 message=bla" FIELDALIAS-user = user AS Account_Name EVAL-userid = case(isnotnull(user),user, isnotnull(sid),sid) in data1 you will miss the Account_Name field even though it is in the data, this cannot be solved with evals in this manner: EVAL-user = coalesce(Account_Name, user) EVAL-userid = case(isnotnull(user),user, isnotnull(sid),sid) Because according to the props.conf spec file: * When multiple EVAL-* statements are specified, they behave as if they are run in parallel, rather than in any particular sequence. * For example say you have two statements: EVAL-x = y*2 and EVAL-y=100. In this case, "x" will be assigned the original value of "y * 2," not the value of "y" after it is set to 100. So in my opinion this is a major breaking change in the way 7.2.x works, and there is no mentioning of it in any doc (spec file/release notes/known issues/.....) ... View more

This is just one of the problems I had with the Splunk_TA_windows... so I desided to make my own windows app... all of the *as_dest_nt_domain regexes are incorrect, also the "wel-col-kv" regex is incorrect. This is what I have now in my transforms.conf: # The default regex for the below 10 *_as_dest_nt_domain stanza is not correct for EventCodes that have more than one Account_Domain field. # The Target Domain is always the second field, the default regex takes in case of two fields everything and not just the last one. [Target_Domain_as_dest_nt_domain] SOURCE_KEY = Target_Domain REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Primary_Domain_as_dest_nt_domain] SOURCE_KEY = Primary_Domain REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Group_Domain_as_dest_nt_domain] SOURCE_KEY = Group_Domain REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Account_Domain_as_dest_nt_domain] SOURCE_KEY = Account_Domain REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [New_Domain_as_dest_nt_domain] SOURCE_KEY = New_Domain REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Domain_as_dest_nt_domain] SOURCE_KEY = Domain REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [User_ID_as_dest_nt_domain] SOURCE_KEY = User_ID REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Security_ID_as_dest_nt_domain] SOURCE_KEY = Security_ID REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Supplied_Realm_Name_as_dest_nt_domain] SOURCE_KEY = Supplied_Realm_Name REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" [Target_Account_ID_as_dest_nt_domain] SOURCE_KEY = Target_Account_ID REGEX = [\-\sa-zA-Z0-9]*(?:(?:\s)(.*))|(.*) FORMAT = dest_nt_domain::"$1" # For some reason there isn't always a "-" in an empty field, and in those cases the value of that field is filled with the name of the next field # Example: dest_nt_domain = "Failure Information:" (EventCode 4625) # to prevent that the wel-col-kv regex (splunk/etc/system/default/transforms.conf) needs to be changed [wel-col-kv] REGEX = (?=\w)([^:\n\r]+):[ \t]*(?![\n\t])([^\n\t]*) ... View more

That is not possible... the iplocation command is a build in command, it is build in the core code of splunk so you can't change it... what I did was create a custom command that pulled the fields from the database. It is some time ago that I did this but I can have al look to see if I can find the code. ... View more

If all the usernames start with an "A" and then have 6 numbers you can use this: ([aA][0-9]{6}) if you just want A111111 to A112311 you can use: ([aA]11[12][0-9]{3}) ... View more

you can use the following search to see the notables that have been suppressed over the given period `notable` | search `suppression` ... View more

I am working on that one, but from a Change Analysis DM view point, to fill the object_attrs field with the name of the attributes that where changed. If you just want all the fields you can just create a regex for it. I think you have 3 options for that 1) create 1 regex that will extract every field available using the <_KEY_1> and <_VAL_1> options ( read the transforms.conf documentation REGEX part) 2) create a regex for every field you want to extract 3) create 1 regex that will get all the "Changed Attributes" field, Note that this will not "hit" if one field is missing I whould go for option 1 because it is the most flexible, despite the fact that it will give me some additional fields without a value ( for example Changed_Attributes) ... View more

I had to do something like this today try the following: | makeresults | eval user="skins", urgency="critical" | sendalert notable ... View more

Don't use |datamodel or the macro.... use | tstats instead that is way faster! only downside for tstats is that you can't use a cidr in your where. your query whould become something like: | tstats summariesonly=t count dc(All_Traffic.dest) as dest_count, values(All_Traffic.dest) as dest from datamodel=Network_Traffic where All_Traffic.action="blocked" by All_Traffic.action, All_Traffic.src | `drop_dm_object_name("All_Traffic")` | search (dest=10.0.0.0/8 OR dest=172.16.0.0/12 OR dest=192.168.0.0/16) AND (src!="10.0.0.0/8" src!="172.16.0.0/12" src!="192.168.0.0/16") | where count>150d | rename dest AS "Destination IP", action as "Action", src as "Source IP" more info on tstats: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats ... View more

Probably a bit late... but for anyone else having this problem. For me the solution was to change the app sharing permissions for the app the correlation search was saved in. When you set them to "global" everything works fine. ... View more

you should add the time range below the search between earliest and latest brackets ( just like the timerange input): <form> <label>Analysis of Splunk users activity</label> <fieldset submitButton="false"> <input searchWhenChanged="true" token="timerange" type="time"> <label>Time range:</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="user"> <label>field1</label> <search> <query>(index=_audit action=search) OR (index=_internal) | dedup user | stats count by user | fields user | sort +user</query> </search> <earliest>$timerange.earliest$</earliest> <latest>$timerange.latest$</latest> <fieldForLabel>user</fieldForLabel> <fieldForValue>user</fieldForValue> <choice value="*">All</choice> </input> </fieldset> </form> ... View more

In thought it was something like $click.$ so in this case $click.Country$ ... View more

I think by default Splunk installs a UF with a Windows installation of Splunk. You do het a warning message when you start the UF that it has changed the Splunk Home path. ... View more

you can change the free database with the commercial one and it will work, you don't get the extra fields however. if you create an limits.conf and use the "db_path" option you can point splunk to the new database and don't have to replace the existing one. also see: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Biplocation.5D ... View more

just make sure you don't set the value to low (below 60 sec or so) because else if you have a slight time difference between your servers you can end up with errors because the job has already been deleted before the result where presented on the screen/ the entire search on all the indexers has been completed. ... View more

Bluecoat logs are a pain in the *** to extract but I think this regex should do the trick: (?<timestamp>[0-9-:\s]{19})\s+(?<time_taken>[^\s]+)\s+(?<c_ip>[^\s]+)\s+(?<cs_username>[^\s]+)\s+(?<cs_auth_group>[^\s]+)\s+(?<x_exception_id>[^\s]+)\s+(?<sc_filter_result>[^\s]+)(?:\s+\"|\s+)(?<cs_categories>[^\"]+)(?:\"\s+|\s+)(?<cs_referrer>[^\s]+)\s+(?<sc_status>[^\s]+)\s+(?<s_action>[^\s]+)\s+(?<cs_method>[^\s]+)\s+(?<rs_content_type>[^\s]+)\s+(?<cs_uri_scheme>[^\s]+)\s+(?<cs_host>[^\s]+)\s+(?<cs_uri_port>[^\s]+)\s+(?<cs_uri_path>[^\s]+)\s+(?<cs_uri_query>[^\s]+)\s+(?<cs_uri_extension>[^\s]+)(?:\s+\"|\s+)(?<cs_user_agent>[^\"]+)(?:\"\s+|\s+)(?<s_ip>[^\s]+)\s+(?<sc_bytes>[^\s]+)\s+(?<cs_bytes>[^\s]+)(?:\s+\"|\s+)(?<x_virus_id>[^\"\s]+)(?:\"\s+\"|\"\s+|\s+\"|\s+)(?<x_bluecoat_applicatoin_name>[^\s\"]+)(?:\"\s+\"|\"\s+|\s+\"|\s+)(?<x_bleucoat_application_operation>[^\"\s]+)(?:\"\s+|\s+)(?<cs_auth_type>[^\s]+) ... View more

then it seems like the "BDexcluded" field is not an number. you can test it with the eval function isnum(X) see https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/CommonEvalFunctions#Informational_functions ... View more

I think the info you miss is in an other intel list you can try the all_threat_intel macro to see if you can find the info you are looking for. In the column threat_collection you can find list/macro that the info is in. ... View more