Skip to content

Commit

Permalink
excluded unnecessary source type
Browse files Browse the repository at this point in the history
  • Loading branch information
hardikhdholariya authored Sep 30, 2024
1 parent 79a0211 commit 6bc165a
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion cyences_app_for_splunk/default/savedsearches.conf
Original file line number Diff line number Diff line change
Expand Up @@ -6526,7 +6526,7 @@ display.page.search.tab = statistics
display.page.search.mode = fast
request.ui_dispatch_app = cyences_app_for_splunk
request.ui_dispatch_view = search
search = index=* sourcetype!="WinRegistry" NOT (sourcetype="WinEventLog" user_type="computer") NOT (sourcetype="meraki:accesspoints" (NOT eventData.identity="*")) NOT (action=fail*) (user=* OR User=* OR UserName=* OR Username=* OR userName=* OR username=* OR user_name=* OR src_user=*) \
search = index=* NOT sourcetype IN ("meraki", "fortigate_utm", "WindowsUpdateLog", "WinRegistry", "Script:ListeningPorts", "Script:InstalledApps", "sophos:xg:idp", "sophos:xg:firewall", "cisco:ios", "MSAD:NT6:DNS", "Perfmon:*") NOT (sourcetype="WinEventLog" user_type="computer") NOT (sourcetype="meraki:accesspoints" (NOT eventData.identity="*")) NOT (action=fail*) (user=* OR User=* OR UserName=* OR Username=* OR userName=* OR username=* OR user_name=* OR src_user=*) \

This comment has been minimized.

Copy link
@VatsalJagani

VatsalJagani Sep 30, 2024

Collaborator

No need to specify every single index, just the sourcetype with huge amount of data. FYI

This comment has been minimized.

Copy link
@VatsalJagani

VatsalJagani Sep 30, 2024

Collaborator

This does not include Palo Traffic sourcetype which is the biggest one

This comment has been minimized.

Copy link
@hardikhdholariya

hardikhdholariya Oct 3, 2024

Author Contributor

Palo traffic has the user info. & above mentioned source types taken from cerberos instance from top 100 high volume sourcetypes

| `cs_user_inventory_data_filter` \
| eval user=mvdedup(mvappend(coalesce(src_user, user, user_name, username,Username, User, UserName, userName), if(mail="null" or mail="",null(),mail))), user_type=coalesce(user_type, user_role, user_category, "n/a") \
| search NOT user IN ("$*", "-", "' or '1=1", ".{jndi", "") \
Expand Down

0 comments on commit 6bc165a

Please sign in to comment.