mastouille.fr est l'un des nombreux serveurs Mastodon indépendants que vous pouvez utiliser pour participer au fédiverse.
Mastouille est une instance Mastodon durable, ouverte, et hébergée en France.

Administré par :

Statistiques du serveur :

620
comptes actifs

#splunk

0 message0 participant0 message aujourd’hui

We’re thrilled to announce that the Investigative Journalism Foundation has been selected as a #Splunk Social Impact grantee helping to bridge the Data Divide!

This opportunity allows us to further our mission of holding power to account by leveraging data for transformative change. Learn more about our journey and other inspiring nonprofits here:

splunk.com/en_us/blog/splunk-f

👋 Hello Mastodon!

I'm Steven Butterworth, aka UKITGURU. I specialise in InfoSec and SIEM technologies (Splunk, Sentinel, Elastic). As a freelancer, I create and deliver SIEM content, working with gov departments and private sectors. Passionate about Data Science, Data Engineering, and data literacy. Avid triathlon enthusiast—never enough bikes! 🚴‍♂️

Looking forward to connecting!

#InfoSec
#SIEM
#Splunk
#Sentinel
#DataScience
#Triathlon
#Cycling

Most of these caves are off the map. This is to protect the delicate and unique geological features (not to mention the bats)

Here is a large lava stalagmite. Unlike those found in a limestone cave, they form all-at-once… like a drippy castle you naught have built at the beach (but with molten lava)

I am not a #DataScience person, so I need the wisdom of the #LazyWeb to help me out, please.

(I’m running queries on #Splunk, but I don’t think this question applies to Splunk only.)

I have a report running hourly to calculate metrics and store these to a separate index (in Splunk terms, a “summary metrics index”), for faster querying later. It's a data roll-up. (1/4)

Splunk security advisories for multiple CVEs in various products (no mention of exploitation):

  • SVD-2024-0301 Splunk Authentication Token Exposure in Debug Log in Splunk Enterprise CVE-2024-29945 (7.2 high)
  • SVD-2024-0302 Risky command safeguards bypass in Dashboard Examples Hub CVE-2024-29946 (8.1 high)
  • SVD-2024-0303 Third-Party Package Updates in Splunk Enterprise - March 2024 (multiple CVEs)
  • SVD-2024-0304 Third-Party Package Updates in Splunk Universal Forwarder - March 2024 (multiple CVEs)
Splunk Vulnerability DisclosureSplunk Authentication Token Exposure in Debug Log in Splunk EnterpriseIn Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process. This exposure could happen when either Splunk Enterprise runs in debug mode or the `JsonWebToken` component has been configured to log its activity at the DEBUG logging level. Normally, Splunk Enterprise runs with debug mode and token authentication turned off, as well as the `JsonWebToken` process configured at the INFO logging level. <br><br>The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) in the Splunk documentation for more information.

Trying to ingest 22.17GB worth of #PCAP files into #splunk on an M2 Pro macmini.
Splunk eventually bailed: still running great but stopped ingesting for unknown reason. The mac is handling that stupid workload pretty nicely considering Splunk is a x86_64 binary, not a native arm64 one.