๐๐๐ซ๐ญ-๐: ๐๐ฎ๐๐ซ๐ฒ๐ข๐ง๐ ๐๐ข๐ฌ๐ฉ๐๐ซ๐๐ญ๐ ๐๐๐ญ๐ ๐ข๐ง ๐๐ฉ๐ฅ๐ฎ๐ง๐ค For the last couple of months, we have been working on the newest release of the Query Federated Search App for Splunk. I wanted to write this educational series as a way to demonstrate the power of what we have been building and why I find importance in the work. SOC teams should pay particular attention. The Query Splunk App enables rapid searching of cybersecurity data stored in various cloud storages, data lakes and SaaS environments other than Splunk itself, such as Amazon S3, Microsoft Defender for Endpoint, and Google BigQuery etc. To know more about the supported data sources, check out our official documentation. This post is focussed on the basic syntax needed to conduct searches across different sources via the Query platform on the Splunk dashboard. To utilize the Query App in Splunk, prepend your syntax with `| queryai`, followed by the `search` command parameter that specifies the search criteria. For example: `| ๐ช๐ฎ๐๐ซ๐ฒ๐๐ข ๐ฌ๐๐๐ซ๐๐ก="<๐๐ข๐๐ฅ๐> = <๐ฏ๐๐ฅ๐ฎ๐>"`. There are more operators available besides equality.ย 1๏ธโฃ EndsWith: <field> = *<value> 2๏ธโฃ StartsWith: <field> = <value>* 3๏ธโฃ Contains: <field> = *<value>* Searching for a value that contains spaces, requires us include the value in quotes Example: | ๐ช๐ฎ๐๐ซ๐ฒ๐๐ข ๐ฌ๐๐๐ซ๐๐ก=โ<๐๐ข๐๐ฅ๐> = โ<๐ ๐ฌ๐๐ง๐ญ๐๐ง๐๐ ๐จ๐ซ ๐ ๐๐๐ฌ๐๐ซ๐ข๐ฉ๐ญ๐ข๐จ๐ง>โโ Additionally, `| queryai` command takes another optional parameter called `platforms` which accepts a CSV string. This allows you to condense your search to specific platforms of your choice. A complete example of that would be: | ๐ช๐ฎ๐๐ซ๐ฒ๐๐ข ๐ฌ๐๐๐ซ๐๐ก=โ<๐๐ข๐๐ฅ๐> = <๐ฏ๐๐ฅ๐ฎ๐>โ ๐ฉ๐ฅ๐๐ญ๐๐จ๐ซ๐ฆ๐ฌ=โ๐๐ฆ๐๐ณ๐จ๐ง๐๐, ๐๐๐๐๐๐๐ง๐๐๐ซ, ๐๐๐๐ โ Hope you got the basic idea about the syntax and there is more to be added in the next release. ๐ฅ Fore more details you can always read our official documentation: https://lnkd.in/g6ynu8Zn Was the post helpful?ย What would you like to see in the future posts? Comment down below. #federatedsearch #splunk #goquery
Aman Bhardwajโs Post
More Relevant Posts
-
How to export data from Defender for Endpoint to Azure Data Explorer #defenderforendpoint #microsoftsecurity https://lnkd.in/d9wa5Y8Y
To view or add a comment, sign in
-
How to export data from Defender for Endpoint to Azure Data Explorer #CoreSecInfra #CloudSecurity #Security #MSDefender #AzureCentric #mvpbuzz #AzureMVP #AzureSecMVP #AzureCentricPodcast #MDE #MDC
How to export data from Defender for Endpoint to Azure Data Explorer
techcommunity.microsoft.com
To view or add a comment, sign in
-
How to export data from Defender for Endpoint to Azure Data Explorer #CoreSecInfra #CloudSecurity #Security #MSDefender #AzureCentric #mvpbuzz #AzureMVP #AzureSecMVP #AzureCentricPodcast #MDE #MDC
How to export data from Defender for Endpoint to Azure Data Explorer
techcommunity.microsoft.com
To view or add a comment, sign in
-
How To Export Data from Defender for Endpoint to Azure Data Explorer #CoreSecInfra #CloudSecurity #Security #MSDefender #AzureCentric #mvpbuzz #AzureMVP #AzureSecMVP #AzureCentricPodcast #MDE #MDC
How To Export Data from Defender for Endpoint to Azure Data Explorer
techcommunity.microsoft.com
To view or add a comment, sign in
-
How To Export Data from Defender for Endpoint to Azure Data Explorer #CoreSecInfra #CloudSecurity #Security #MSDefender #AzureCentric #mvpbuzz #AzureMVP #AzureSecMVP #AzureCentricPodcast #MDE #MDC
How To Export Data from Defender for Endpoint to Azure Data Explorer
techcommunity.microsoft.com
To view or add a comment, sign in
-
How To Export Data from Defender for Endpoint to Azure Data Explorer #CoreSecInfra #CloudSecurity #Security #MSDefender #AzureCentric #mvpbuzz #AzureMVP #AzureSecMVP #AzureCentricPodcast #MDE #MDC
How To Export Data from Defender for Endpoint to Azure Data Explorer
techcommunity.microsoft.com
To view or add a comment, sign in
-
๐ Gurucul ๐ federated search empowers users to run queries from a single console across any data source, including data lakes, cloud object storage, databases, identity systems, threat intel sources, and SIEMs โ including Splunk. " #gurucul #siem #federatedsearch #datalake #splunk #nextgensiem
Gurucul Enhances Federated Search Capabilities Across Multiple Data Sources
datanami.com
To view or add a comment, sign in
-
How to export data from Defender for Endpoint to Azure Data Explorer #CoreSecInfra #CloudSecurity #Security #MSDefender #AzureCentric #mvpbuzz #AzureMVP #AzureSecMVP #AzureCentricPodcast #MDE #MDC
How to export data from Defender for Endpoint to Azure Data Explorer
techcommunity.microsoft.com
To view or add a comment, sign in
-
How To Export Data from Defender for Endpoint to Azure Data Explorer #CoreSecInfra #CloudSecurity #Security #MSDefender #AzureCentric #mvpbuzz #AzureMVP #AzureSecMVP #AzureCentricPodcast #MDE #MDC
How To Export Data from Defender for Endpoint to Azure Data Explorer
techcommunity.microsoft.com
To view or add a comment, sign in
-
When I worked at #splunk, one of the things that customers loved about the product was its blazing fast performance when analyzing indexed #log data for #observability and #cybersecurity. And one of the things they frequently raised concerns about was the high cost of keeping large volumes of historical and verbose data โliveโ within Splunk. Well, Splunk has been listening, and in the past few years have launched great features like Ingest Actions and Edge Processor (Google these if you arenโt aware of them!). These features allow customers to filter and route data, sending some data (for example filtered log records) to Splunk, while sending other data (eg. unfiltered logs) to an #aws #s3 endpoint. Because Snowflake can easily work with semi-structured data landed in S3, this allows our joint customers to route their โSplunk-worthyโ data to Splunk and leverage the Snowflake #datacloud to store longer term, unfiltered log data. And with Snowflakeโs Search Optimization feature, this data can now be searched, analyzed, and aggregated at massive scale.ย For Splunk users, simple integration with Snowflake using DBConnect means all of this data is still searchable in Splunk! Want to learn more? Check out this great presentation (and live demo of the integration described above) from our own Jake Berkowsky. https://lnkd.in/gyEhACqXย
To view or add a comment, sign in
-