How to Use Splunk SIEM for Logs Analysis & Events Monitoring | TryHackMe Fixit
In this video walkthrouugh, we discussed Splunk configuration files namely, props.conf,transforms.conf,fields.conf,inputs.conf, indexes.conf and mentioned the purpose and goal of each one of them. Splunk configuration files are used to configure log parsing rules, fields extraction and set log storage and retention rules. Use these config files when Splunk doesn't extract the fields properly from the provided log file or when you have unique format for your logs. For demonstration purposes, we solved TryHackMe Fixit challenge that lets us to practically test our knowledge in configuring log parsing rules with Splunk.
*****
Receive Cyber Security Field, Certifications Notes and Special Training Videos
/ @motasemhamdan
******
Writeup
https://motasem-notes.net/en/event-an...
TryHackMe Fixit
https://tryhackme.com/r/room/fixit
********
Google Profile
https://maps.app.goo.gl/eLotQQb7Dm6ai...
LinkedIn
[1]: / motasem-hamdan-7673289b
[2]: / motasem-eldad-ha-bb42481b2
Instagram
/ dev.stuxnet
Twitter
/ manmotasem
Facebook
/ motasemhamdantty