I believe the command you are looking for is scrub. I attended .Conf last year where an instructor used this command to replace "real data" with dummy information, while keeping the format of the data.  This command comes in useful when wanting to anonymize the data, when passing it on to a 3rd party etc. I use it when pasting data into 3rd party websites, to work on Regex extractions. |scrub     ... View more

I enjoyed taking the beta exam. Do you have an idea when roughly the final pass / fail results will be available for this cert? ... View more

This is what I wanted to confirm... Again, I'm new to this whole data model thing - and was looking for best practices around some of these issues I've been coming across. Thanks for getting back with me! ... View more

Thanks for your reply... not sure how your response will be help me. The Windows TA is already filling-in "null" for the src field. I was wondering if that is a valid result for a data model?  I'm looking at this from an investigative perspective - if a Security Analyst were to pull up the auth data model and look for failed logins, and sees events with a src of null.  They would only know the dest server, user etc. - and not be able to see where these authentication events originated from.  That is what I am trying to better understand... is there a way to "complete the picture"? A best practice around this?   ... View more

I'm not using Windows events - but I was able to get your query to run. Mine looks more like: index=stuff sourcetype=more:stuff  InterestingField=authorized earliest=-14d&d latest=now | eval time_wday=strftime(_time,"%A") |search NOT (time_wday="saturday" OR time_wday="sunday") | stats count BY User_Name Results are: User_Name                          Count  User1                                      600 User2                                         55 User3                                    4321 etc. If we use User1 where a count of 600 is returned - we can assume over the last 14 days (excluding weekends) - the user logged-on 60 times per day. I want to trigger an event if that user now exceeds 10% of his daily count. So... 66 events per day or more. My thoughts are I can show those users based on the following: | where count>=1.1*dailyAverage   I'm just missing the dailyAverage part.   ... View more

I believe the future is to make Phantom the single-pane of glass. We too have ES and Phantom, and are trying to best figure out how to best leverage these products. ... View more

I would also take a hard look at your existing playbooks, to see where they are failing. Might be time to optimize them further and follow best practices. ... View more

We have an unlimited user license, so I cannot comment on Q2. However, for every user who you setup on Phantom is indeed counted- even though you are using external auth. When you create a user, you are doing it on Phantom itself. Only difference is that this user is either marked as a local account, automation account or you are using external auth such as SAML or LDAP etc. ... View more