Hello Splunkers, Where do I go to leave feedback or suggestions for Splunk? I have the following suggestion but don't know where to send it. Hello Splunk, It would be very helpful if there were a way to do some of the CLI commands from the web interface. This is the primary way even our administrators interact with Splunk and for security reasons there is almost no remote access to the Splunk server. This makes entering CLI commands a big hassle. One example of something it would be nice to do with a button (maybe on the "Server Controls" page) is reloading the deployment server. We are constantly tweaking the inputs for our workstations and a button to push out the updated conf files would save us a ton of hassle. https://answers.splunk.com/answers/247605/why-is-the-deployment-server-not-pushing-updated-i.html ... View more

Hello Splunkers, Not sure if "enriching" is the right term to use but I'm hoping someone can point me in the direction of some documentation that will help me get more information into, and out of, a dashboard panel. The "Infosec app for Splunk" has an "All Authentications" dashboard. (Infosec app>Continuous Monitoring>All Authentications) On that dashboard there is a panel that is titled "Authentication Attempts by Application" The search powering the panel is | tstats summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where Authentication.app="*" Authentication.action=* by Authentication.app | rename "Authentication.*" as "*" The results I get look like this: app and count win:local 690 win:remote 8328 win:unknown 8784 Is there any way I can get this to identify the actual app? Looking through the settings I see that the "Authentication.app" field is calculated using an eval expression (below), by the Authentication data model. if(isnull(app) OR app="",sourcetype,app) I'm not sure if this is what needs to be adjusted and I'm terrible with eval expressions and regex so rather then mess something up I thought I would ask here first. Any help is greatly appreciated. System details: Stand-alone Splunk Enterprise Version: 7.3.0 Build: 657388c7a488 CIM: 4.14.0 Some of the installed Add-ons/Apps: Microsoft Sysmon Add-on Microsoft Windows DHCP add-on for Splunk Splunk Add-on for Microsoft Windows Splunk Add-on for Microsoft Windows DNS Splunk Add-on for PowerShell Splunk App for Windows Infrastructure Splunk Supporting Add-on for Active Directory Sysmon App for Splunk ... View more

Hello Splunkers, I'm hoping to get some help investigating a potential IOC. Here is the situation, my Infosec app for Splunk (https://splunkbase.splunk.com/app/4240/) dashboard has flagged a system for possible bruteforce attempt. I have identified the system (a workstation), the account name being attempted ("host"), the logon target (Domain) and some what of a pattern for attempts (2-3 attempts per 30 minute block and decreasing port number with each attempt for as long as the system is on regardless of whether or not a user is logged in). What I can't find out, is the process involved. (I can't figure out what is trying to login) I tried google searching for malware that has this same behavior but didn't find anything. I have used "TcpLogView" in an attempt to log the process that is opening the port but, it seems that it opens and closes too quickly for TcpLogView to see it, as the ports listed in the events are not listed by TcpLogView. I have even installed Splunk forwarder on this workstation to gain some visibility but I don't know if I'm ingesting the right data. So, how can I identify what is making the attempts? Thank you in advance for any help or suggestions. Update: These login attempts continue even if the system is running in safemode (with networking). Here is a log entry showing the failed attempt with ##comments and some *redaction. This event was generated by the DC. 09/10/2019 02:31:04 PM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4768 EventType=0 Type=Information ComputerName=*DC-Name TaskCategory=Kerberos Authentication Service OpCode=Info RecordNumber=3587264684 Keywords=Audit Failure Message=A Kerberos authentication ticket (TGT) was requested. Account Information: Account Name: host Supplied Realm Name: *Domain-name User ID: NULL SID Service Information: Service Name: krbtgt/*Domain-name Service ID: NULL SID Network Information: Client Address: 192.168.10.170 ##workstation's IP Client Port: 53169 Additional Information: Ticket Options: 0x40800010 Result Code: 0x6 ##Client not found in Kerberos database Ticket Encryption Type: 0xFFFFFFFF Pre-Authentication Type: - ... View more

Hello Splunkers, I keep getting the error message "Could not load lookup=LOOKUP-app_proto" in multiple apps on multiple dashboards. I have checked settings and neither the lookup file or definition existed and I can't figure out what is asking for this lookup. I can't find a reference to a lookup by that name in any documentation or on any of the Splunk sites. I have created a lookup with a matching name but I don't know where to put it. I added it to the search app but I still got the error, then I added it to an app getting the error and that didn't work either. Basic system info is below, let me know what other info you would like and I will provide it as soon as I can. Thanks for reading. Stand-alone Splunk Enterprise Version: 7.3.0 Build: 657388c7a488 CIM: 4.13.0 Apps: (Not all apps listed) InfoSec App for Splunk (getting error on some dashboards) Network Traffic App for Splunk (not getting the error) Cisco Security Suite (getting error on all dashboards) Obelisk Threat Intel (getting error on all "Splash" page dashboards) Splunk Security Essentials (getting error on "app awareness" dashboards) Splunk Stream (getting error on all informational dashboards) Firegen for Cisco ASA (getting error on all summary page dashboards) Cisco Firepower App for Splunk (getting error on all default dashboards) ... View more

Hello Splunkers, I have the InfoSec for Splunk App (https://splunkbase.splunk.com/app/4240/#/overview) installed and working. I'm getting data into it and it is using that data. My issue is that when I go to an alert (any alert) it will show me the stats but not any of the actual events. (Yes it is in verbose mode) The events tab shows X number of events but when I click the events tab it says "no results". I think (please correct me if I'm wrong) this is normal behavior if using the tstats command, so how can I look at the actual events the search is finding? I don't have enough karma points to add screenshots but this is the search the alert is using. | tstats summariesonly=t allow_old_summaries=t count from datamodel=Authentication by Authentication.action, Authentication.src | rename Authentication.src as source, Authentication.action as action | chart last(count) over source by action | where success>0 and failure>20 | sort -failure | rename failure as failures | fields - success, unknown For my data this returns 2 IPs and the number of failures for each. I think that these are false positives (some app, utility, script, etc. with an old password) but need to see the actual events to be certain. Thanks for taking the time to read this. System details Stand-alone Splunk Enterprise 7.3 InfoSec app version 1.4 CIM version 4.11 ... View more