topic ForeScout CounterACT Integration Module: How to change the index for the counteract web_event sourcetype? in Deployment Architecture

ForeScout CounterACT Integration Module: How to change the index for the counteract web_event sourcetype?

tungntran — Mon, 22 Feb 2016 20:24:45 GMT

Hi All,

I was able to get counteract module to forward data using "web_event" sourcetype. However, all the data resides in the "main" index. Does anyone have any tips on how to change the index for the data being forwarded by counteract integration module?

Thanks,
Tung

Re: ForeScout CounterACT Integration Module: How to change the index for the counteract web_event sourcetype?

tungntran — Tue, 23 Feb 2016 01:22:07 GMT

Figured it out.

In the counteract policy for Splunk, edit the condition. Under the "HTTP Request" tab for the "DEX Send Web..." action add the index name.

Original:
https://[IP]:[port]/services/receivers/simple?source=CounterACT&sourcetype=web_event

Changed index:
https://[IP]:[port]/services/receivers/simple?index=counteract&source=CounterACT&sourcetype=web_event