https://community.splunk.com/t5/All-Apps-and-Add-ons/Anonymous-Internet-access-after-installed-Template-for/m-p/138089#M11699 <P>Where are you seeing this (as in what log or Splunk query)?</P> <P>There isn't anything in the Template for XenApp that would cause this.</P> Wed, 24 Sep 2014 14:59:06 GMT jconger 2014-09-24T14:59:06Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Anonymous-Internet-access-after-installed-Template-for/m-p/138088#M11698 <P>Recently, we've received suspicious Internet sites access (see below sites) attempts on server installed after installed the Template for Citrix XenApp. I'd like to know is it possible to eliminate it and how can I fix it. Many thanks!</P> <PRE><CODE>23.77.208.152 akamai 203.104.131.6 NHN Japan 23.77.208.155 akamai 23.77.209.48 akamai 23.13.165.163 akamai 63.88.100.178 Verizon Business 63.88.100.192 Verizon Business 23.13.171.27 akamai 63.88.100.139 Verizon Business 63.88.100.178 EXPEDIA.COM </CODE></PRE> Wed, 24 Sep 2014 04:08:49 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Anonymous-Internet-access-after-installed-Template-for/m-p/138088#M11698 jaleun 2014-09-24T04:08:49Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Anonymous-Internet-access-after-installed-Template-for/m-p/138089#M11699 <P>Where are you seeing this (as in what log or Splunk query)?</P> <P>There isn't anything in the Template for XenApp that would cause this.</P> Wed, 24 Sep 2014 14:59:06 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Anonymous-Internet-access-after-installed-Template-for/m-p/138089#M11699 jconger 2014-09-24T14:59:06Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Anonymous-Internet-access-after-installed-Template-for/m-p/138090#M11700 <P>We've seen it on the firewall log and the Internet access attempts stopped after we add the %splunkhomefolder%\etc\apps\TA-XA6x-Server\local\app.conf and with the statement "state = disabled". The Internet access attempts resume right after I change the statement to "state = enabled". And I can see the attempts are generated by Powershell.exe via port 80. Any clues? Many thanks! </P> Thu, 25 Sep 2014 04:16:06 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Anonymous-Internet-access-after-installed-Template-for/m-p/138090#M11700 jaleun 2014-09-25T04:16:06Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Anonymous-Internet-access-after-installed-Template-for/m-p/138091#M11701 <P>You can run the PowerShell scripts from the command line outside of Splunk to see if anything is wrong there. Also, make sure something hasn't hijacked the actual .ps1 files in</P> <PRE><CODE>SPLUNK_HOME\etc\apps\TA-XA6x-Server\bin\powershell </CODE></PRE> <P>You can also compare what you have to the source located at:<BR /> <A href="https://github.com/splunk/splunk-template-xenapp/tree/master/app/TA-XA6x-Server/bin/powershell">https://github.com/splunk/splunk-template-xenapp/tree/master/app/TA-XA6x-Server/bin/powershell</A></P> Fri, 26 Sep 2014 04:05:10 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Anonymous-Internet-access-after-installed-Template-for/m-p/138091#M11701 jconger 2014-09-26T04:05:10Z