I am fairly certain that Splunk is the worst piece of shit software I have ever had to endure in any job.

Splunk patched the CSRF bug (and a gazillion others I didn't find)! I guess I get to stop adding it to reports ...

https://advisory.splunk.com/advisories

What does not work and takes +5h?
This: `splunk fsck repair --all-buckets-all-indexes`

What does work and takes few seconds?
That: `zfs rollback -r flash/vm/rocky8-splunk@H-2025-01-30_14.00.01--48h`

My company finally upgraded #Splunk to get the feature that everyone wants. No, not #AI - #DarkMode!

Hello #splunk users!
I have a (hard) question about the Splunk Machine Learning Toolkit:

https://community.splunk.com/t5/Splunk-Search/Using-Machine-Learning-Toolkit-to-detect-auth-abuse/m-p/709165#M239684

I’m an absolute newbie with the MLT…
Feel free to #help / #retoot / #boost

Do I know anyone who works for/on #splunk ?
I'm evaluating its #accessibility for #screenReader users v8.26 for the #tryHackMe #AdventOfCyber challenges and let's just say I have some feedback to share. I can absolutely see that work has been done but I think an expert review is sorely needed :) Who do I talk to about that? #infoSec #cybersecurity

Hey fellow #OpenSearch fans. I'm curious if there's a way to do #Splunk syntax type searches? I came to OpenSearch from solr, graylog, and ELK, so I'm generally content with Lucene syntax, but overcoming the muscle memory has been more challenging from some coworkers that are used to Splunk. I would love to see OpenSearch become more of the goto over Splunk and this capability would go a long way to making that happen.

JOB ALERT
My team (#Splunk #SURGe) is looking for a mid- or senior-level researcher. The job involves participating and leading research teams, then publishing and speaking about what you learn for the benefit of the #cybersecurity community. We are a small team, but very supportive of each other and extremely collaborative. If this sounds like you, apply today!

https://buff.ly/3YqqI8h

I think I'll have to switch my homelab SIEM from Elastic to Splunk given I've been doing too much training at work and personal that references Splunk. I very much enjoy Elastic but the knowledge of Splunk will be more beneficial for my professional career.
#homelab #siem #splunk #elastic

The Top Cyber Threats for 2024/25

YouTube video: https://youtu.be/A4hHWDcPHqE

#SponsoredbyCisco #ai #artificalintelligence #Quantum #cisco #firewall #vpn #hash #encryption #theats #ransomware #hack #hacking #cybersecuity #splunk Cisco Splunk

Hey, I just tested an instance of Splunk and I didn't find this! How did I miss...

"According to Splunk, only instances running on Windows machines are affected by this vulnerability."

Oh. Never mind.

https://www.securityweek.com/splunk-enterprise-update-patches-remote-code-execution-vulnerabilities/

Cisco Talos Incident Response is now available to all #Splunk customers! Learn how Talos IR can help you assess, strengthen and evolve your cybersecurity program and make sure your systems are resilient against the worst-case scenarios http://cs.co/6017YdCpd

DB-Engines Ranking climbers of the month:

#Oracle

#SQLServer

#Splunk

https://db-engines.com/en/ranking

Hello Mastodon!

I'm Steven Butterworth, aka UKITGURU. I specialise in InfoSec and SIEM technologies (Splunk, Sentinel, Elastic). As a freelancer, I create and deliver SIEM content, working with gov departments and private sectors. Passionate about Data Science, Data Engineering, and data literacy. Avid triathlon enthusiast—never enough bikes!

Looking forward to connecting!

#InfoSec
#SIEM
#Splunk
#Sentinel
#DataScience
#Triathlon
#Cycling

Got to bring my father into one of the larger caves - a new experience for him.

Today I learnt MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 encapsulates LDAP Authentication on Windows Domain controllers where a request is made by LDAP(S).

This is after I have spent years following trusting most of the advice online that it’s an artifact of NTLM authentication and the local security authority (LSA). For the better part of a decade I had assumed these were being generated by legacy windows devices using NTLM, but never working out why there were so many of them.

It all makes sense now! And now at least I have a better understanding of some of the events I am looking at!

I am not a #DataScience person, so I need the wisdom of the #LazyWeb to help me out, please.

(I’m running queries on #Splunk, but I don’t think this question applies to Splunk only.)

I have a report running hourly to calculate metrics and store these to a separate index (in Splunk terms, a “summary metrics index”), for faster querying later. It's a data roll-up. (1/4)