The notable event search opens Incident Review scoped to events with the TSPY_FAKEMS.C malware signature. Perform a Notable Event Search on the signature using the field actions.The malware Signature is TSPY_FAKEMS.C, a virus definition from TrendMicro. Choose one of the High or Critical Host With Malware Detected events to investigate.Filter the notable events by urgency, viewing only the High and Critical events in the Endpoint security domain.Log in to Splunk Enterprise Security and view the Incident Review dashboard.

Review notable events identified by Splunk Enterprise Security to see the current state of threats in your environment. Web surfing activity logs normalized to the Proxy object of the Web CIM data model.Īssess the current state of security incidents.See Install and deploy add-ons in the Installation and Upgrade Manual for details on integrating Enterprise Security with Splunk Stream. For example, DNS queries collected by Splunk Stream. DNS lookup data normalized to the Network Resolution CIM data model.See Install and deploy add-ons in the Installation and Upgrade Manual. For example, Trend Micro OfficeScan server data, which can be added to Splunk Enterprise Security using TA-trendmicro, included with ES. Endpoint anti-malware logs normalized to the Malware CIM data model.See Add asset and identity data to Splunk Enterprise Security in Administer Splunk Enterprise Security. Asset information in the asset lookup.This use case relies on the following data sources, ingested into the Splunk platform in compliance with the Splunk Common Information Model: This use case walks you through using Splunk Enterprise Security and DNS (domain name system) data to identify patient zero in a malware outbreak in your environment. Quickly identifying 'patient zero' allows you to readily contain a malware outbreak, eliminate the malware from that machine while preventing reinfection, and learn more about the application and/or files that delivered the malware. Malware outbreaks can cripple an organization's computer systems. Use DNS data to identify malware patient zero

Dns worm virus