rba
rba copied to clipboard
Published
20 hours ago •
splunk
splunk
Fix for issue #124
Hello, warning: you may have a limit on list (the stat list truncates results to 100 results)
'stats' command: limit for values of field 'threat_object' reached. Some values may have been truncated or ignored.
'stats' command: limit for values of field 'threat_object_type' reached. Some values may have been truncated or ignored.
@L0ranCyb Yes, I noticed this. The values repeat for each RBA detection, so I think this can safely be disregarded as we're keeping only unique values later in the SPL. I used list to keep the 2 fields in original order during the aggregation so I can properly "stitch them" together later. Figured this was also still better than wrong information (which the current panel SPL returns).
That being said, I'll try to find time to look at a potentially better alternative.