topic Re: "Windows Event Code Security Analysis" not work in Installation

"Windows Event Code Security Analysis" not work

hamanako — Mon, 26 Apr 2021 02:21:21 GMT

Hi, my name is hamanako.

I would like to use "Windows Event Code Security Analysis", but when I select the "Lookup OverView" or "Table Analysis" menu, I get the following error.

Please let me know how to solve this problem.

Error message:
The app you requested is not available on "splunk_wineventcode_secanalysis".
The app you requested is not available on this system. Check the spelling of the app, or choose another from the following list:

Environment:
OS: Windows 2012
Splunk Enterprise 8.1.2 (Free)

Windows Event Code Security Analysis Version 1.3
　 file name: splunk_wineventcode_secanalysis
https://github.com/stressboi/splunk_wineventcode_secanalysis

Re: "Windows Event Code Security Analysis" not work

mamesuke — Thu, 01 Jul 2021 02:42:21 GMT

Please change the link to the following.

https://<hostname>/en-US/app/splunk_wineventcode_secanalysis/lookup_overview?

↓

https://<hostname>/en-US/app/splunk_wineventcode_secanalysis-master/lookup_overview?

Re: "Windows Event Code Security Analysis" not work

hamanako — Thu, 01 Jul 2021 14:42:11 GMT

>> mamesuke

Thank you very much for your answer.
I was able to show the "Lookup Overview" by adding "-master" to the link.

How can I get the "Lookup Overview" to appear when I click the "Lookup Overview" menu from the "Windows Event Code Security Analysis" screen?

Re: "Windows Event Code Security Analysis" not work

mamesuke — Fri, 02 Jul 2021 13:13:13 GMT

Please remove the app and install it again.

If you download it from github, it will be named "splunk_wineventcode_secanalysis-master.zip".

But when you add it to your splunk app, rename the zip file as follows

splunk_wineventcode_secanalysis-master.zip

↓　　　remove "-master"

splunk_wineventcode_secanalysis.zip

Re: "Windows Event Code Security Analysis" not work

hamanako — Sat, 03 Jul 2021 10:16:43 GMT

>> mamesuke

I followed the instructions you provided, but to no avail.

1) Remove the current app
opt/splunk/bin/splunk remove app splunk_wineventcode_secanalysis-master
2) Download new splunk_wineventcode_secanalysis-master.zip from github
3) Rename the file to "splunk_wineventcode_secanalysis.zip"
4) Import splunk_wineventcode_secanalysis.zip from "install app from file".

On github, there is the following description
"I haven't done anything with the "properly populated signature_id field!" because I don't know how to do that, is this relevant here?

　"REQUIRES COMMON INFORMATION MODEL 4.14+ with properly populated signature_id field!"

Environment:
# /opt/splunk/bin/splunk display app
Splunk_SA_CIM CONFIGURED ENABLED INVISIBLE
Splunk_TA_windows UNCONFIGURED ENABLED INVISIBLE
splunk_wineventcode_secanalysis-master UNCONFIGURED ENABLED VISIBLE

Re: "Windows Event Code Security Analysis" not work

mamesuke — Mon, 05 Jul 2021 04:57:17 GMT

I didn't explain it well enough.

1) Remove the current app
opt/splunk/bin/splunk remove app splunk_wineventcode_secanalysis-master
2) Download new splunk_wineventcode_secanalysis-master.zip from github

3) Extract the file. and rename the folders in the folder.
　splunk_wineventcode_secanalysis-master/splunk_wineventcode_secanalysis-master/appserver(bin,default...)
↓
splunk_wineventcode_secanalysis-master/splunk_wineventcode_secanalysis/appserver(bin,default...)

4) Compress the folder
　splunk_wineventcode_secanalysis/appserver(bin,default...)　→　splunk_wineventcode_secanalysis.zip

5) Import splunk_wineventcode_secanalysis.zip from "install app from file".

Your environment is fine.

I hope your problem is solved soon.

Re: "Windows Event Code Security Analysis" not work

hamanako — Thu, 08 Jul 2021 10:10:33 GMT

>> mamesuke

Special Thanks!

By following the instructions you provided, the app worked as expected.
I was finally able to solve the problem.

I apologize for the late reply.
Thank you very much for your detailed explanation.