apply_base_localconfidence_filter(4) macro to 0.90Updates & Fixes
- Changed Syntax in ml_intel threat collection to use update=true|false instead of 1 or 0 for filtering and clarity
- Updated Threat Intelligence Review Dashboard to Provide a filtering option (search for domains, filter unlabelled domains)
- Improved the KV Store Audit functionality for users that are changing the labels (DGA|LEGIT) in the ml_intel collection
- Update the correlation search to include CDN_INTEL for filtering out false positives earlier in the process
- Added a one-time use migration search to update the ml_intel collection to the new update=true or false values
- Improved Z^2 Daemon's Deduplication search to maintain update status and other fields
- Added a new field to ml_intel to store the confidence of a class prediction, this is overwritten when the class is confirmed by the analyst with confirmed_dga or confirmed_legit
- Updated documentation with steps to add a view to the ES menu bar. (Known bug with tablebutton.js not loading when viewing in the ES app context.)
--- Pre-GA Release ---
This add on is the release candidate for the GA version that will go live at .conf20.
It requires the following apps to work fully:
Enterprise Security 6.x: https://splunkbase.splunk.com/app/263/
Url Toolbox 1.8: https://splunkbase.splunk.com/app/2734/
Machine Learning Toolkit 5.2: https://splunkbase.splunk.com/app/2890/
Python for Scientific Computing 2.0: https://splunkbase.splunk.com/app/2882/
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.