About m1ster1985

m1ster1985 · ‎09-21-2021

Thank you very much. You are right, I do not have appropriate knowledge in ES. 😞 Hope, I will fix it in the near future. After enabling objects in Content Management, I started receiving notable events.

m1ster1985 · ‎09-21-2021

Thank you very much. I enabled objects in the Content Management and Security Posture instantly filled with different events.

m1ster1985 · ‎09-20-2021

Thank you for the reply. The Incident Review dashboard is also empty. I have executed a request and nothing empty result. But when I review events using Security Domains, I see a lot of events. For instance, Access Centre. Very strange, I have no idea why this is happening in this way.

m1ster1985 · ‎09-19-2021

I have installed Enterprise Security App. I review Security Domain, in particular, Access and Network sections and I see many events coming from my AD, Office 365, and Firewalls. However, Security Posture dashboards are all empty. I have checked permissions and given full access. Could you advise what I should check to fix it?

m1ster1985 · ‎05-28-2020

Dear all, I have installed Splunk Enterprise Security but the Security Posture dashboard does not show any information. Security intelligence in particular Risk Analysis does not show any information as well. I have reviewed all guides related to Enterprise Security configuration and I do not see any issues with my configuration. Generally, Splunk is collecting many logs including Office 365 logs, AD logs, and Firewall logs, and they are perfectly displayed on Apps that are specialized for particular vendor logs (for instance Microsoft 365 app for Splunk). However, they are not reflected in Enterprise Security. I have configured "Intelligence Downloads" by enabling almost all types of threats and almost all of them are downloaded successfully. I am a new person in using Splunk and do not have a decent experience of configuring Splunk. I have no idea what I should check or configure to find out the core of the problem. Could you help me in addressing this issue? I am ready to provide my current configuration if it is needed.

m1ster1985 · ‎01-14-2020

Unfortunately, I can't copy the output of the btool command because it is too big and can't attach a file due to a lack of point for karma. Probably, you want to see particular strings?

m1ster1985 · ‎01-13-2020

Hello, This is the first problem. I configured inputs.conf that is located in /opt/splunk/etc/apps/Splunk_TA_windows/local having indicated the following configuration: [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" index = wineventlog renderXml=false I also copied this configuration to the deployment server (/opt/splunk/etc/deployment-apps/Splunk_TA_windows/local). The configuration is successfully transmitted to the computer with Universal Forwarder. (I checked the configuration of the UF) However, when I look at event logs in the "Search and Report", I see that logs are coming with the index = "main" instead of "wineventlog" as I pointed in the inputs.conf selected fields: host = ComputerNAME index = main source = XmlWinEventLog:Security sourcetype = XmlWinEventLog I have no idea why event logs are coming with the index = main. I configured eventid.net in the following way: "The EventId App will analyze the specified index: (index="wineventlog" OR source=XmlWinEventLog*)"

m1ster1985 · ‎01-10-2020

Dear all, Could you help me in resolving my issue I cannot address? I installed Add-on for Microsoft Windows and did everything according to instruction. Now, Splunk is receiving logs from 1 windows computer. I can see them in the data summary. The next step was the installation eventid.net app to consolidate and visualize received logs. However, when I installed and configure it according to the instruction, eventid.net does not show any logs on its dashboards. I have no idea where should I look into to find out why eventid does not work. Please, could you help me in troubleshooting this problem? I am ready to provide any screenshots of my configuration. These are some details of my configuration. I configured inputs.conf that is located in /opt/splunk/etc/apps/Splunk_TA_windows/local having indicated the following configuration: [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" index = wineventlog renderXml=false I also copied this configuration to the deployment server (/opt/splunk/etc/deployment-apps/Splunk_TA_windows/local). The configuration is successfully transmitted to the computer with Universal Forwarder. (I checked the configuration of the UF) However, when I look at event logs in the "Search and Report", I see that logs are coming with the index = "main" instead of "wineventlog" as I pointed in the inputs.conf selected fields: host = ComputerNAME index = main source = XmlWinEventLog:Security sourcetype = XmlWinEventLog I do not understand why event logs are coming with the index = main. I configured eventid.net in the following way: "The EventId App will analyze the specified index: (index="wineventlog" OR source=XmlWinEventLog*)" Thank you.

Posts	8
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎01-10-2020

Online Status	Offline
Date Last Visited	‎09-22-2021 01:35 PM

Enerprise Security posture is empty

Splunk Enterprise Security does not show Security ...

eventid.net

Re: Enerprise Security posture is empty

Re: Enterprise Security posture is empty

Re: Enerprise Security posture is empty

Enerprise Security posture is empty

Splunk Enterprise Security does not show Security ...

Re: eventid.net

Re: eventid.net

eventid.net