About Splunkometry88

Splunkometry88 · ‎09-17-2020

Thanks for the suggestion, I have progressed a little bit, as the file needs to be imported by Splunk ES i've done the below to create a new CSV file with the correct delimiting fields and then import the records from a downloaded file I’ve managed to get the python working to create the new CSV file and I’ve got the command right to read the file but I need to get this imported into the url field in the newly created file The script below creates the file but I’m just printing to shell at the end where I should be importing the df = pd.read_csv command into the newly created CSV file in the field 'url' I'm looking at using pandas import csv import pandas as pd with open('destinationfile.csv', 'wb') as csvfile: filewriter = csv.writer(csvfile, delimiter=',', quotechar='|', quoting=csv.QUOTE_MINIMAL) filewriter.writerow(['description', 'http_referrer', 'http_user_agent', 'url', 'wei$ df = pd.read_csv (r'/filepath/sourcefile.csv)' print df Have a think about this, maybe there’s an easier way to do it

Splunkometry88 · ‎09-16-2020

Hi Splunkers I have a CSV download with URL threat intel which is a flat file with URLs listed, I will import these into the Splunk Enteprise Security App however I need to add more columns to the file to allow the import Currently the file is flat showing just URLs as below https://testurl.com https://testurl1.com https://testurl2.com https://testurl3.com I need to add the columns as below and have the URLs land in column 4 (url) as shown below description,http_referrer,http_user_agent,url,weight More of a *nix question but if anyone can assist with how I might edit this CSV to add those columns would be great. I download the file via a CRON job so I'll create another job to run the import script after the download Any help appreciated Thanks

Splunkometry88 · ‎09-10-2020

Hi There! I would like to send the email when the status is either 1 or 5 i.e. Open/Closed This is a clunky way of trying to interface with an external ticketing system

Splunkometry88 · ‎09-09-2020

Hi Team I am searching to confirm the SPL to poll a KV Store check the status of the es_notable_events when a status changes and then send an email, also would like to check timestamps to work out what the newest event is The SPL i have working to send (most of the time) is below | inputlookup es_notable_events where status="1" | sendemail to=email@address.com format=raw subject=Splunk Notable Event sendresults=true Appreciate any help

Splunkometry88 · ‎09-09-2020

Hi Team, As part of an integration from Splunk ES into a ticketing system, we're trying to monitor the notable_events KV Store and create a scheduled search when the status field changes that also sends an email when it notices the status change Has anyone else tried this or could the logic work to do this? Appreciate this is a clunky way to do this but would be great to get some ideas

Splunkometry88 · ‎09-02-2020

Hi Team I am looking to send an email alert once the notable event is closed, I can send an email when the notable event is created but I cannot seem to find a way to send an email when the notable event is closed

Splunkometry88 · ‎09-01-2020

Hi all I have a threat feed that is available via using an API key only, I could not see any way to add the API key to the threat intel download option? I can manually create a CURL command to download the file to the right folder but this will not be registered as an intel file. Thanks

Posts	7
Solutions	0
Karma Given	6
Karma Received	0
Member Since	‎08-23-2020

Online Status	Offline
Date Last Visited	‎10-05-2020 06:26 PM

Question on shell script for linux

KV Store Lookup to Email with timestamp search

Monitor Notable Event KV Store, Send Email via sch...

Send email on Notable Event close action

Adding manually downloaded Threat Intel file into ...

Re: Question on shell script for linux

Question on shell script for linux

Re: KV Store Lookup to Email with timestamp search

KV Store Lookup to Email with timestamp search

Monitor Notable Event KV Store, Send Email via sch...

Send email on Notable Event close action

Adding manually downloaded Threat Intel file into ...