ESXi - Splunk Threat Hunting App issue

[liviurosioara]

Hi again,

I managed to deploy the lab on a ESXi 7.0.3 host running on Intel NUC 11.

The only issue I have now is related to Splunk Threat Hunting App which shows zero threats all the time. I tried executing all Atomic Red Bomb tests and there are no changes after that.

The Threat Hunting App complains about missing threathunting_asset_priority.csv. I created this file similar to the instructions posted here: https://github.com/clong/DetectionLab/issues/706 however no significant changes. I also unarchived the whitelist csv files from Olaf.

[Cris5955]

Hi again,

I managed to deploy the lab on a ESXi 7.0.3 host running on Intel NUC 11.

The only issue I have now is related to Splunk Threat Hunting App which shows zero threats all the time. I tried executing all Atomic Red Bomb tests and there are no changes after that.

The Threat Hunting App complains about missing threathunting_asset_priority.csv. I created this file similar to the instructions posted here: https://github.com/clong/DetectionLab/issues/706 however no significant changes. I also unarchived the whitelist csv files from Olaf.

Out spanish goo Luke/intro_(*)