If you’re in the David Veuve camp, you know the value of using the tstats command to achieve performant searches in Splunk. In this blog, I’ll focus on using Stream to improve Splunk performance for search while lowering CPU usage. Stream optimizes data so that it’s consumable again. TDR Device Summary - improved drilldown of third rowħ.2 Platform: Platform Independent CIM Versions:ħ.0 Platform: Platform Independent CIM Versions:Ĥ.x Platform: Platform Independent CIM Versions:Ĥ.An ex-colleague at Splunk asked me in a LinkedIn post if Cribl Stream does anything else besides log reduction. All syslog dashboards now use the cylance_index macro to populate the Tenant dropdown eventtype=cylance_index now uses a macro: cylance_index Added FilePath to Syslog Overview Top Script Control Interpreter Panel Drilldown Added syslog threat detail dashboard (Threat Center -> Syslog Threat Detail) Added top devicename w/ zonename to syslog script control Added top devicename w/ zonename to syslog exploits Added wildcard search to the indicator correlation dashboards Added top policy and top zone to TDR device summary Added syslog indicator correlation (tools -> Syslog Indicator Correlation) eventtype and tag permissions set in ta to better expose data to Splunk ES props/nf added TRANSFORMS-devicehostname_ns = protecthostname_ns to rename host field for threat.py events nf file created to specify the cylance_index: definition = index=protect OR index=cylance_protect Bug in source populating search on audit dashboard changed to syslog - | tstats count where cylance_index AND sourcetype=syslog by source | table source Corrected typo in API connector usage table (api_connector)
Syslog Device Summary Count fix - NOT sourcetype="syslog_audit_log" Syslog Overview - Unique Devices query fix - added NOT "Device Names" NOT AuditLog Syslog Threats - actions field from Threats - always shows unknown Syslog Overview - actions field from Threats - always shows unknown Syslog Overview - Submit button removed to keep consistent Syslog Optics File, Process, Memory, Network, and Registry dashboards Syslog Optics parsing in props and transforms Syslog Overview -> Correlation search to add Zone information to Audit Log Threats Waived panel Added Wildcard search to Auditing dashboard Downloading CylancePROTECT App for Splunk
0 kommentar(er)
