splunk / attack_data

A repository of curated datasets from various attacks
Apache License 2.0
570 stars 94 forks source link

how do I make splunk es to check my uploaded logs #894

Open maybe-why-not opened 3 months ago

maybe-why-not commented 3 months ago

I have installed splunk es app and uploaded botsv1.stream_http.json image but incident_review and ess_security_posture is not hitting any event image how do I make splunk es to check my uploaded logs and generate a list of alerts like below. Please note that I am not checking the logs forwarded by agent, but the log files uploaded on the browser side image thank you