search

clong / DetectionLab

Automate the creation of a lab environment complete with security tooling and logging best practices
MIT License
4.57k stars 976 forks source link

ESXi - Splunk Threat Hunting App issue #733

Open liviurosioara opened 2 years ago

liviurosioara commented 2 years ago

Hi again,

I managed to deploy the lab on a ESXi 7.0.3 host running on Intel NUC 11.

The only issue I have now is related to Splunk Threat Hunting App which shows zero threats all the time. I tried executing all Atomic Red Bomb tests and there are no changes after that.

The Threat Hunting App complains about missing threathunting_asset_priority.csv. I created this file similar to the instructions posted here: https://github.com/clong/DetectionLab/issues/706 however no significant changes. I also unarchived the whitelist csv files from Olaf.

Cris5955 commented 1 year ago

Hi again,

I managed to deploy the lab on a ESXi 7.0.3 host running on Intel NUC 11.

The only issue I have now is related to Splunk Threat Hunting App which shows zero threats all the time. I tried executing all Atomic Red Bomb tests and there are no changes after that.

The Threat Hunting App complains about missing threathunting_asset_priority.csv. I created this file similar to the instructions posted here: https://github.com/clong/DetectionLab/issues/706 however no significant changes. I also unarchived the whitelist csv files from Olaf.

Out spanish goo Luke/intro_(*)