About Kevin149

Kevin149 · 06-03-2020

Our CMDB is a bit of a mess (working on that as we speak) and I sometimes get VI's that are matched incorrectly to a CI. Is there a way for me to just reassign a VI to a DIFFERENT CI without going and changing matching rules and deleting the CI tabl...

Kevin149 · 05-27-2020

Yes for sure. I guess the main limitation that was a deal breaker for us was you didn't have the ability to send calculated data over to service now using the Splunk Enterprise Event Ingestion for Security Operations plugin. Meaning the only way to...

Kevin149 · 05-27-2020

For what it's worth I recently was a part of integrating Splunk ES with ServiceNow and we found that trying to push data from splunk TO servicenow using a ServiceNow API and then mapping fields to Security Incident tickets was a pain in the butt, and...

Kevin149 · 05-13-2020

You could possibly use the API to create a custom table where you list superseding patches and then use that table to create a workflow or business rule to exclude them. The API for qualys has an endpoint you can hit to list superseding patches. ht...

Kevin149 · 05-13-2020

Did you ever find a solution to this? I'm dealing with a pretty ugly CMDB and I'm finding that specifically with Desktops/Laptops the CI matching is abysmal. What happens is that a VI gets created and it can't find a CI so it just creates a new rec...

User Activity

How to fix a mis-matched CI manually?

Re: Difference between 'Splunk ES Integration for Security Operations' plugin & 'Splunk Enterprise Event Ingestion for Security Operations' plugin?

Re: Difference between 'Splunk ES Integration for Security Operations' plugin & 'Splunk Enterprise Event Ingestion for Security Operations' plugin?

Re: Is there a way to exclude superseded QIDs

Re: Discovered Items not matching existing CI