So I continue my journey to get this cert, I think I have procrastinated for too long and I need to get back to learning all the ins and outs for the technology. Again this certification is very heavy on configuration, HA concepts and maybe scattered between all their main Objectives. We are going to […]
Palo Alto Networks – PCNSE Certification Part 3: Basic Configuration (Admin Roles) Read More »
Lack of quality information in Cyber Security and incident response is real, you have too many sources for too many things, and most of the information at reach is not centralized. A couple of years back when I was working on learning more and more ins and outs on the InfoSec community I found VERIS,
Cybersecurity Tools – VERIS Incident Model Read More »
Introduction to Knowledge objects These are tools you use to discover and analyze various aspects of your data * Data Interpretation – Fields and field extractions * Data Classification – Event types * Data Enrichment – Lookups and Workflow Actions * Normalization – Tasks and Field Aliases * Datasets – Data models Knowledge objects can
Splunk Series II: Knowledge Objects and Managing Fields Read More »
Introduction to Transactions A transaction is a group of related events that span time. Events can come from multiple applications or hots. For example, One email message can create multiple events as it travels through various queues, also visiting a single website normally generates multiple HTTP requests Transaction field-list can be one list field or
Splunk Series II: Correlating Events Read More »
Introduction to Eval Commands The eval commands are great to perform calculations, convert values, road values, format values and even use conditional statements. It is recommended to use search and were commands to filter calculated results. Eval commands allow you to calculate and manipulate field values in your report Supports a variety of functions Results
Splunk Series II: Filtering/Formatting Data Read More »
Visualizations When a search returns statistical values, the results can be viewed with different visualization types, some of the Visualization types: Statistical Values Charts: Line, column, pie Single Value Visualizations Maps Charts – Line Chart (Time Series) Chart – Bubble Cluster Map Choropleth Map What is next? Filtering/Formatting Data About the Author: Andres Sarmiento, CCIE
Splunk Series II: Visualizations Read More »
SO we got to this point, looking at the Fundamentals 2 section of my training. This training builds on the Fundamentals 1 course. Which is pretty much all tools you can use for searching and understanding data in Splunk What is part fo Fundamentals 2: Transforming commands and Visualizations Filter/Format results of a Search Correlate
Splunk Series II: Fundamentals II Read More »
How is the syntax used in the Search editor To better explain the syntax of a search is by using the following diagram The components of the Search Search Terms –> What you are looking for Commands –> What do you want to do with the results, chart, statistics, format and so on Functions –>
Splunk Series: Search Language Syntax Read More »
Fields are searchable key/value pairs in your event data Fields can be searched by their name, for example: area_code=404 action=purchase status=200 When you look for multiple items in the editor an implied AND will be implied unless specified otherwise (AND, OR, NOT) to the search as follows action=purchase AND status=200 Field Discovery Splunk automatically discovers
Splunk Series: Field searches Read More »
Every search is also a job, which can be paused, stopped, saved and exported. Here are some interesting things you need to know about Search jobs: Jobs are available for 10 Minutes (By Default) Jobs can have the following permissions as part of the configuration when they are saved Private – Only the creator can
Splunk Series: Saving Search Jobs Read More »
