topic Re: How do we Parse logs of Secret Server in Splunk Cloud in Getting Data In

How do we Parse logs of Secret Server in Splunk Cloud

AL3Z — Wed, 16 Aug 2023 15:07:53 GMT

Hi,

Are there any available applications to address the issue of incorrect parsing of secret server logs in Splunk cloud?

Thnks

Re: How do we Parse logs of Secret Server in Splunk Cloud

richgalloway — Wed, 16 Aug 2023 20:53:18 GMT

How can the servers be secret if they're logged in Splunk? 😀

Splunkbase may have add-ons that help parse the logs, but they're unlikely to be listed as "secret". Use the vendor or product name to search for relevant add-ons.

Chances are, however, that you'll need to build your own add-on. It's not hard - an add-on is just a collection of .conf files (mainly props and transforms).

The process can be made easier by exporting the problematic events to a file (use "raw" mode). Use the Add Data wizard to upload the file and experiment with settings until you find the right ones to parse the events. Then you can copy those settings into your add-on.

Upload the add-on to Splunk Cloud and see how it improves parsing. Iterate as necessary.

Re: How do we Parse logs of Secret Server in Splunk Cloud

AL3Z — Thu, 24 Aug 2023 11:52:31 GMT

Hi @richgalloway ,

Can you help me building an add-on like step by step processes of it, is there any article/video available ?

Thanks

Re: How do we Parse logs of Secret Server in Splunk Cloud

richgalloway — Thu, 24 Aug 2023 12:57:52 GMT

I'm not aware of a step-by-step tutorial for creating apps, but it's pretty simple. The hardest part may be getting the app to pass vetting by Splunk Cloud.

Start by creating a directory for your app. For example, $SPLUNK_HOME/etc/apps/my_app/default. You can change "my_app" to anything you like, but leave the rest of the path unchanged.

Create a props.conf file in the directory. Add content to that file as necessary to parse your data. If you add any transforms, be sure to create a transforms.conf file in the same directory.

Create an app.conf file in the directory. Populate it as specified at https://dev.splunk.com/enterprise/reference/appinspect/appinspectcheck#Appconf-standards

Package the app using tar (or equivalent command) to create a .tgz file. Do not perform this step on Windows because the file permissions will not be saved correctly.

Upload the app to Splunk Cloud and review the vetting results. Update the app to correct any failures reported. Repeat this step until there are no reported failures.

Install the app.

Re: How do we Parse logs of Secret Server in Splunk Cloud

AL3Z — Fri, 10 Nov 2023 07:22:22 GMT

Hi
Would you be able to set up an app or custom parser for me.
Thanks...

Re: How do we Parse logs of Secret Server in Splunk Cloud

richgalloway — Sun, 29 Oct 2023 13:09:51 GMT

I cannot do that. That's a job for Splunk Professional Services.

Re: How do we Parse logs of Secret Server in Splunk Cloud

AL3Z — Sun, 29 Oct 2023 17:59:17 GMT

@richgalloway

Atleast pls guide me steps so that I can work on it.

Is it an easy to do ?

Re: How do we Parse logs of Secret Server in Splunk Cloud

richgalloway — Sun, 29 Oct 2023 23:23:46 GMT

Yes, it's easy to do. See my reply on 24 Oct.

Re: How do we Parse logs of Secret Server in Splunk Cloud

inventsekar — Mon, 30 Oct 2023 01:09:01 GMT

Hi @AL3Z ... As said by Rich's reply, the Splunk App or Add-on building can be an easy task if some development experience you got.

maybe, if you are really interested, you could learn it. most apps / add-ons are simple and easy.

I went to the link you provided, looks good. give it a try and update us your views, maybe we can suggest you something, thanks.

Re: How do we Parse logs of Secret Server in Splunk Cloud

AL3Z — Wed, 06 Dec 2023 12:18:17 GMT

...

Re: How do we Parse logs of Secret Server in Splunk Cloud

inventsekar — Tue, 31 Oct 2023 00:48:28 GMT

Hi @AL3Z .. Could you pls edit the sample log(remove all important things like ip address, usernames, any sensitive info), thanks.

the props and transforms... it requires some homework from your side. I will try my best to create and suggest you back, thanks.

Re: How do we Parse logs of Secret Server in Splunk Cloud

AL3Z — Tue, 31 Oct 2023 07:36:11 GMT

Hi, @inventsekar ,

Can you pls create a few fields so that I can create a remaining fields ..

Thanks

Re: How do we Parse logs of Secret Server in Splunk Cloud

richgalloway — Tue, 31 Oct 2023 20:38:20 GMT

Example field extractions in props.conf look like this

EXTRACT-action = Action: \[(?<action>[^\]]+)\] EXTRACT-user = User: (?<user>\S+)

What follows the = is a regular expression very much like what is used with the rex command. With these examples and a little experimentation in regex101.com you should be able to extract the remaining fields.

If you have troubles, please post the field you're trying to extract and the command you tried.

Re: How do we Parse logs of Secret Server in Splunk Cloud

AL3Z — Fri, 03 Nov 2023 13:36:49 GMT

@richgalloway ,

We can do the Event Action Extract Fields instead on creating the props/transforms right ?

Thanks

Re: How do we Parse logs of Secret Server in Splunk Cloud

richgalloway — Fri, 03 Nov 2023 17:19:23 GMT

I believe you can do that.

Re: How do we Parse logs of Secret Server in Splunk Cloud

AL3Z — Mon, 06 Nov 2023 07:06:49 GMT

Hi @richgalloway ,

Can we use general regex to extract all the fields having key value pair.

I have installed a custom app on another SH, where we typically install all apps to distribute the load, but it is not reflecting (the configurations are not working) on another SH in ES. What could be the reason?

In the custom app, the object owner is not showing any user after installation. How can we change it under all configurations in the UI of SH, we doesn't have backend access.

Thanks

Re: How do we Parse logs of Secret Server in Splunk Cloud

richgalloway — Mon, 06 Nov 2023 13:22:09 GMT

The preferred way to parse key/value pairs is to use KV_MODE=auto in props.conf.

An app installed in one SH will have no effect on other SHs. Install the app on the ES SH for the configuration to have effect.

To change the owner of an object, click the Reassign Knowledge Objects button in the top-right corner of the All Configurations page.

Re: How do we Parse logs of Secret Server in Splunk Cloud

AL3Z — Mon, 06 Nov 2023 15:00:52 GMT

Hi @richgalloway ,
Could you pls make changes as you requested.

This is the regex used in the tranforms
https://regex101.com/r/YhoZHW/1

My transforms looks like

[key_value_pair] REGEX = (\w+)=(.*?)(?=\s\w+=|$) FORMAT = $1::$2 props.conf [delinea:secretserver] category = Custom description = Secret Server Logs EXTRACT-event_id_name = \|Secret Server\|[^\|]*\|(?<event_id>[^\|]*)\|(?<event_name>[^\|]*)\| REPORT-key_value_pair = key_value_pair # Field renames FIELDALIAS-cs1 = cs1 as modified_role_name # FIELDALIAS-cs1label = cs1label as modified_role_name FIELDALIAS-cs2 = cs2 as user_or_group_name # FIELDALIAS-cs2label = cs2label as user_or_group_name FIELDALIAS-cs3 = cs3 as folder_name # FIELDALIAS-cs3label = cs3label as folder_name FIELDALIAS-cs4 = cs4 as source_user FIELDALIAS-fname = fname as target_item FIELDALIAS-rt = rt as event_time

Thanks..

Re: How do we Parse logs of Secret Server in Splunk Cloud

richgalloway — Mon, 06 Nov 2023 15:09:35 GMT

props.conf

[delinea:secretserver] category = Custom description = Secret Server Logs EXTRACT-event_id_name = \|Secret Server\|[^\|]*\|(?<event_id>[^\|]*)\|(?<event_name>[^\|]*)\| #REPORT-key_value_pair = key_value_pair KV_MODE = auto

Re: How do we Parse logs of Secret Server in Splunk Cloud

AL3Z — Mon, 06 Nov 2023 16:52:26 GMT

Hi @richgalloway ,

Now where I can edit the props in the SH, I dnt have backend access ?