About mark_wymer

mark_wymer · ‎04-13-2022

Thanks for getting back to me Tom. I've dropped you a PM in return. Cheers, Mark.

mark_wymer · ‎04-13-2022

Hi everyone, I just watched an excellent demo / tutorial ( https://my.phantom.us/video/78/ ) by someone called Ian Forrest. During the video ( at about 45 minutes ) he demo's an excellent Custom Function that looks in the cached SOAR internals for the cached results from previous executions of a specific app/action. He did mention that this was a 'work in progress' and I can't find this CF in Community Hub nor on Github anywhere. Does anyone know what the status of his Custom Function is? Cheers, Mark.

mark_wymer · ‎03-10-2022

Hi Tom, Thanks for getting back to me. I did think that it may be a tall ask but hey-ho 🙂 I'll raise a request as you suggested. Cheers, Mark

mark_wymer · ‎03-09-2022

Hi all, Does anyone know if it's possible to use Cyberark to rotate the Splunk SOAR admin account password? If it is, do you have any pointers to get this solution implemented? As always, any help is most gratefully received, Mark.

mark_wymer · ‎01-19-2022

Thanks Tom - perfect 😊

mark_wymer · ‎01-19-2022

Hi Tom, hope your well. Not 'spoken' for ages. So, if I understand.... Pass the ID data from the artifact into a custom code snippet to write the data to, effectively, a temporary file then use the Phantom Vault API to upload this into the container (can the temporary file be deleted then or is the 'upload' just a pointer to the physical location?) This can then be attached to the email. Mark.

mark_wymer · ‎01-19-2022

Hi all, Does anyone know if it's possible to create a file from a field in an artifact? Scenario: We have an alert in Splunk SIEM that sends various bits of, tabulated, info to SOAR. One of the fields is a comma delimited list of ID's - this could be 1 or several hundred This kicks off a playbook to process this info and email the info to the 'owner' The ID data must be added to the sent email as an attachment I'm aware of the option to add attachments from the file vault to an email from SOAR using the smtp app but...... How do we get the ID data from the field in the artifact into a file? Any help would be much appreciated. Cheers, Mark.

mark_wymer · ‎10-22-2021

Hi all, I’m just about to upgrade our Phantom / Splunk SOAR version to 5.0.1. The Version Compatibility matrix in the documentation for the Phantom Remote Search app suggests that this version isn’t supported though ( https://docs.splunk.com/Documentation/PhantomRemoteSearch/1.0.17/PhantomRemoteSearch/Abouttheapp ) I’m sure that it is compatible but could someone please confirm before I upgrade my Production Phantom platform. Also, just an observation…. 14 indexes!!!! Would it not be more in keeping with general recommendations / strategy to have 1 index (or more for multiple Phantom instances) and have multiple sourcetypes? many thanks, Mark

mark_wymer · ‎06-23-2021

Hi all, Is there a way to configure the Introspection Partition monitor to check other filesystems rather than just the hotwarm & cold FS's? We have a separate filesystem for our Frozen buckets with scripts to delete buckets over a certain number of days old. Mostly this works well in our cluster but, occasionally, these fill up and prevent the cold buckets from being rolled over. This, then causes other problems. I'd like to be able to monitor the frozen FS to try and predict / prevent a full FS before it happens. I would rather use the Introspection app if possible. Cheers, Mark.

mark_wymer · ‎02-03-2021

Hi @guilmxm Thanks for getting back to me, I appreciate that you were busy getting the next update ready. I have now upgraded to your latest version and I still have the same anomaly. If it helps with troubleshooting, I've taken some snapshots: Please feel free to PM be if you prefer. Thanks, Mark.

mark_wymer · ‎01-28-2021

Hi, Ignore the above. The message and state has now cleared / changed to Green. It cleared after I closed the Actions window and reopened it ( possible bug? ). So, I guess the solution for anyone else hitting this or a similar issue - close the Action window and re-open it. Cheers, Mark

mark_wymer · ‎01-28-2021

Hi, I've got an issue with one of my Data Sources where TrackMe falsely detected a Data Sampling anomaly and, consequently, set the state to Red and the Status Message to: Alert: data source status is red, monitoring conditions are not met due to anomalies detected in the data sampling and format recognition, review the data sampling window to investigate. This alert means that trackMe detected an issue in the format of the events compared to the format that was previsouly identified for this source. I used the 'Clear state and run sampling' from the Data Sampling tab and that is now Green. The Status Flipping tab also shows the object_state as Green but the 'state' ( in the summary at the top) is still Red and the Status message is still the same (as above). However, I've just noticed that the Timeline in the Status Message tab also shows as 'Green'??? How can I drill down into why TrackMe is showing both a Red and Green status for the same Data Source? Many thanks, Mark.

mark_wymer · ‎08-27-2020

The solution that I found, and as mentioned by others in different scenarios, is that the Metrics Index has to be defined on the searchheads as well as the indexer cluster. This is unlike an event index which does not, necessarily, have to be defined on a searchheads. Once I added an indexes.conf for that index on the SH, everything worked fine.

mark_wymer · ‎08-27-2020

Hi, thanks for your response. I cut down the actual SPL for brevity but I do understand your point. Being new to Metrics indexes any pointers are always useful. i have, however, resolved my issue (posted separately).

mark_wymer · ‎08-26-2020

Hi all, I'm using the (excellent) TrackMe app which uses a Metrics Index. The index has been created on a Indexer Cluster and I've verified that it is actually there ( /opt/splunk/bin/splunk list index -datatype metric ). However, when I try and search the index using | mcollect split=t index="trackme_metrics" I get the following: "Error in 'mcollect' command: Must specify a valid metric index" This is the 1st and only metrics index on our cluster so I cannot verify that other metrics indexes work OK. Also, the only suggested resolution to this seems to be that I should put the metrics index on our searchhead cluster - but that makes no sense to me! Am I doing something wrong or is there some setting that I need to configure before I can use a metrics index? Many thanks, Mark.

mark_wymer · ‎02-11-2020

Thanks for the answer / confirmation Nick.

mark_wymer · ‎02-11-2020

Hi all, Our environment consists of, amongst other things, a multisite (3) clustered environment. Each site has three indexers making a total of nine indexers. We also have a replication factor of 3. On each indexer the hot/warm and cold buckets are on separate filesystems. On one of the indexers, the filesystem containing the cold buckets suffered a hard disk failure which has destroyed the entire FS. My question is: when the disk/filesystem is repaired, will Splunk automatically rebuild the cold buckets from the replications? If it does, will it do it when I start Splunk or is there some maintenance commands that I will need to issue? Many thanks, Mark.

mark_wymer · ‎01-12-2020

Hi, Will this (most excellent) app (Chargeback Analysis for Splunk) be certified for use with Splunk 8.x? Mark.

mark_wymer · ‎03-11-2019

Hi Lakshman, Thanks for the response - I'll try it out. I suspect, though, that it's the actual python script that can't handle an 'unknown' response from macvendors.co If you have a number of mac addresses to look up, the 1st one that 'fails' causes the entire search string to stop. Regards, Mark.

mark_wymer · ‎03-08-2019

Hi, Similar to a previous question, under certain circumstances the maclookup fails with an error message: command="maclookup", : failed to use the netaddr module! After a bit of digging (and a reference in a previous question) this appears to happen when a MAC address is not found in any lists online or offline. Fails: | makeresults | eval src_mac="0A:58:0A:F4:01:01" | maclookup Works: | makeresults | eval src_mac="00:50:56:AB:64:11" | maclookup In these instances, shouldn't the script return something like "Unknown Vendor"? Regards, Mark.

Posts	20
Solutions	1
Karma Given	1
Karma Received	1
Member Since	‎03-08-2019

Online Status	Offline
Date Last Visited	‎09-01-2022 11:28 AM

SOAR Custom Function - check_cached_data- Does any...

Is it possible to use Cyberark to rotate the Splun...

SOAR - Create File from Artifacts

Splunk Phantom Remote Search Compatibility

Introspection - Monitor Additional Partitions

Trackme Status Message Not Clearing

Unable to access Metrics Indexes

Hard disk Failure on One Index in a Cluster

'Chargeback Analysis for Splunk' app for Splunk v8

TA-maclookup fails when "No Vendor Exists" for a M...

Re: SOAR Custom Function - check_cached_data

SOAR Custom Function - check_cached_data- Does any...

Re: Splunk SOAR Admin Password Rotation