Members

Use this splunk search to get datails about alert actions
| rest /services/saved/searches splunk_server=local count=0
|table title,actions

(in reflected attacks a lotof external benign src’s send a lotof packets toward our servers, because our server’s IP spoofed before in request packets and were sent by attacker toward trusted servers and those […]

Use this splunk search to show Alert’s cron_schedule details:
| rest /services/saved/searches splunk_server=local count=0
| search “cron_schedule”=”*/*”
|table title,cron_schedule,author

| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path = “/etc/ssl/certs/*” Filesystem.file_path IN […]

index=* sourcetype=”juniper:firewall”  src!=”192.168.*”
| bin _time span=5m
| stats dc(dest_port) as distinct_port by src,dest,_time
|where distinct_port >1000

index=*
((((EventCode=”4688″ OR EventCode=”1″) AND  ((CommandLine=”*reg*” CommandLine=”*add*” CommandLine=”*/d*”) OR (CommandLine=”*Set-ItemProperty*” CommandLine=”*-value*”)) AND (CommandLine=”*00000000*” OR […]