Splunk python script trap issue

satkan100 — Sun, 24 Feb 2019 06:32:05 GMT

IN my environment i am using python script to sent trap .please find the script below ...
Script is working fine using this i am able to generate the incident through tool.
For my concern is i have received only one source detail in the incident.
i need all the source details what ever available in the column need to sent in trap server .

Please help any one...

import os
import csv
import gzip
import subprocess
import shlex
os.chdir(os.path.dirname(__file__))

if __name__ == "__main__":
#Read the environment variables that Splunk has passed to us
                scriptName = os.environ['SPLUNK_ARG_0']
                numberEventsReturned = os.environ['SPLUNK_ARG_1']
                searchTerms = os.environ['SPLUNK_ARG_2']
                queryString = os.environ['SPLUNK_ARG_3']
                searchName = os.environ['SPLUNK_ARG_4']
                triggerReason = os.environ['SPLUNK_ARG_5']
                browserUrl = os.environ['SPLUNK_ARG_6']
                rawEventsFile = os.environ['SPLUNK_ARG_8']

#file where you want to write the content   
logFile = open('D:\Splunk\splunk_alert_events.txt', 'a')


#We got the file name from the envioenment vars
eventFile = csv.reader(gzip.open(rawEventsFile, 'rb'))

#logFile.write(eventFile)
i=0
for row in eventFile:
  if i==0:
   i+=1
  else:
   myhost=row[2]
   source=row[3]
   sourcetype=row[1]
   logFile.write(myhost + "\n")
   logFile.write(browserUrl + "\n")
   logFile.write(scriptName + "\n")
   logFile.write("queryString" + "\n")


logFile.close()

logFile = open('D:\Splunk\splunk_alert_trapsDC.txt', 'a')
proc = subprocess.Popen(['C:\Windows\System32\VivekB.exe','-d', '10.182.73.70','-v', '1.3.6.1.4.1.4842.200.1.0','STRING',myhost,'-v', '1.3.6.1.4.1.4842.200.1.1','STRING',source,'-v', '1.3.6.1.4.1.4842.200.1.2','STRING',browserUrl,'-v', '1.3.6.1.4.1.4842.200.1.3','STRING',sourcetype,'-v', '1.3.6.1.4.1.4842.200.1.4','STRING',scriptName,'-v', '1.3.6.1.4.1.4842.200.1.5','STRING',queryString,'-v', '1.3.6.1.4.1.4842.200.1.6','STRING',searchName,'-v', '1.3.6.1.4.1.4842.200.1.7','STRING',triggerReason],shell=False)
logFile.write(proc + "\n")
logFile.close()

logFile = open('D:\Splunk\splunk_alert_trapsDR.txt', 'a')
prog = subprocess.Popen(['C:\Windows\System32\VivekB.exe','-d', '10.182.73.164','-v', '1.3.6.1.4.1.4842.200.1.0','STRING',myhost,'-v', '1.3.6.1.4.1.4842.200.1.1','STRING',source,'-v', '1.3.6.1.4.1.4842.200.1.2','STRING',browserUrl,'-v', '1.3.6.1.4.1.4842.200.1.3','STRING',sourcetype,'-v', '1.3.6.1.4.1.4842.200.1.4','STRING',scriptName,'-v', '1.3.6.1.4.1.4842.200.1.5','STRING',queryString,'-v', '1.3.6.1.4.1.4842.200.1.6','STRING',searchName,'-v', '1.3.6.1.4.1.4842.200.1.7','STRING',triggerReason],shell=False)
logFile.write(prog + "\n")
logFile.close()

Re: Splunk python script trap issue

lakshman239 — Tue, 26 Feb 2019 09:59:07 GMT

Are you using Splunk Enterprise Security and referring to notables/incidents? is your python script is a modalert adaptive response based? Have you looked at using Add-on-Builder app to create your alert?

topic Re: Splunk python script trap issue in Splunk Dev

Splunk python script trap issue

Re: Splunk python script trap issue