About honey4sec

honey4sec · ‎01-23-2020

Hi. Short intro, im a Senior Security Analyst who also happens to be a Splunk Certified power user. I have been working in the security industry for 8y in a company with more then 90k employees. What do you want to write about in your thesis? What is your field of study I can tell you from knowledge that throwing false grenades is generally a bad idea. It creates distrust and disruptions in regards to real incidents. Your free to dm me if you want to talk.

honey4sec · ‎03-28-2019

Hi, I am currently trying to create a search that looks at NetFlow data from all our hosts using a specified port 389 The value(traffic) is not fixed as some of our hosts have a normal hight chattiness using LDAP. So my problem is that I haven't figured out how to create a search that's able to find the spikes in traffic. What i do is trying to count packets, and say if the volume is doubled within the timewindow of 10 minutes, create an alert for that one host(src_ip) Any tips or tricks? I did try creating a search using moving average but the visual representation was all mumbled using timechart.

honey4sec · ‎01-20-2017

The ip Field looks like this 192.168.3.35-192.168.3.47 I don't think think the answer apply to this. But im not a splunk superman yet

honey4sec · ‎01-20-2017

Hi we currently consuming threat intelligence data and want to correlate this in Splunk in a good way. The problem is that some of the feeds deliver IP addresses in the format of ip-ip and not ip/subnet. How can i make Splunk look at ip-ip as individual IP addresses to match against our firewall logs?

Posts	4
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎01-20-2017

Online Status	Offline
Date Last Visited	‎05-11-2022 07:36 AM

How do you use NetFlow to detect traffic spikes ov...

How to search on IP range and not IP subnet?

Re: Security: Is a fake alert app useless?

How do you use NetFlow to detect traffic spikes ov...

Re: How to search on IP range and not IP subnet?

How to search on IP range and not IP subnet?