topic Re: Splunk Security Essentials - macro 'summariesonly_config' cannot be found in Splunk Enterprise Security

Splunk Security Essentials - macro 'summariesonly_config' cannot be found

corti77 — Fri, 30 Aug 2024 10:40:59 GMT

Hi,

I am testing the Security Essentials App 3.8.0 in Splunk 9.0.8, and I found the same issue while trying to activate the following contents:

Unknown Process Using The Kerberos Protocol
Windows Steal or Forge Kerberos Tickets Klist
ServicePrincipalNames Discovery with SetSPN
Rubeus Command Line Parameters
Mimikatz PassTheTicket CommandLine Parameters

In all cases above, I get two errors:

"Must have data in data model Endpoint.Processes" is in red even though I have installed several Add-ons suggested as compatible such as
- Splunk Add-on for Microsoft Windows 8.9.0
- Palo Alto Networks Add-on for Splunk 8.1.1
Error in 'SearchParser': The search specifies a macro 'summariesonly_config' that cannot be found.
I searched that missing macro and indeed it does not exist. Should I create it manually? With which value?

Do you have any idea how to fix those two errors?

Many thanks

Re: Splunk Security Essentials - macro 'summariesonly_config' cannot be found

richgalloway — Fri, 30 Aug 2024 14:40:12 GMT

Installing add-ons is not enough to populate a datamodel. You must have indexed data that matches what the datamodel looks for and is tagged appropriately.

None of the listed SE content uses a macro called `summariesonly_config`. Creating one is likely to be the easiest way around this error. I would set the definition to 'summariesonly=true'.

Re: Splunk Security Essentials - macro 'summariesonly_config' cannot be found

corti77 — Mon, 02 Sep 2024 09:34:53 GMT

Hi @richgalloway ,

you were right.

The datamodel "Endpoint" was not properly configured, whitelisted indexers were empty.

I added the index wineventlog but it still appears in red. But whenever I click on the "open search" link next to the red icon, that query does get data.
any idea of what might be happening here?

Also, I created the macro "summaryonly_config" as you suggested but new errors appeared related to the other two missing macros "oldsummaries_config" and "fillnull_config".

I also created these macros with a true value in both cases. that seems to solve the issue with the search, no more errors are shown.

thanks

Re: Splunk Security Essentials - macro 'summariesonly_config' cannot be found

richgalloway — Mon, 02 Sep 2024 15:17:53 GMT

Is the Endpoint DM accelerated? If not, then setting indexes won't accomplish anything. Also, the data in the wineventlog index must be CIM-compliant. See the CIM Manual for the field names expected by the DM. Use field aliases and EVALs in props.conf to create the fields.

Re: Splunk Security Essentials - macro 'summariesonly_config' cannot be found

corti77 — Mon, 02 Sep 2024 15:58:52 GMT

hi again @richgalloway ,

the model is accelerated and contains data.

and I use the latest version of the Microsoft add-on 8.9.0 which is CIM compliant.

any other idea?

many thanks