All Apps and Add-ons

Can this app be used for a self-hosted Trellix instance?

PReynoldsBitsIO
Explorer

IHAC that is trying to ingest logs from their self-hosted Trellix instance.   When I try to add an account, the URL field only lists:

  • Global
  • Frankfort
  • India
  • Singapore
  • Sydney


There is no other input field to specify an actual FQDN/IP.  Am I missing something, or is this feature not present?

Labels (1)
Tags (3)
0 Karma

tscroggins
Influencer

Hi @PReynoldsBitsIO,

URL options are specified in $SPLUNK_HOME/etc/apps/Trellix_Splunk/appserver/static/js/build/globalConfig.json:

...
                        {
                            "field": "url",
                            "label": "URL",
                            "help": "Select a unique URL for this account. Refer to https://docs.trellix.com/ to get specific FQDN and Region for your account",
                            "required": true,
                            "type": "singleSelect",
                            "options": {
                                "disableSearch": true,
                                "autoCompleteFields": [
                                    {
                                        "value": "https://arevents.manage.trellix.com",
                                        "label": "Global"
                                    },
                                    {
                                        "value": "https://areventsfrk.manage.trellix.com",
                                        "label": "Frankfort"
                                    },
                                    {
                                        "value": "https://areventsind.manage.trellix.com",
                                        "label": "India"
                                    },
                                    {
                                        "value": "https://areventssgp.manage.trellix.com",
                                        "label": "Singapore"
                                    },
                                    {
                                        "value": "https://areventssyd.manage.trellix.com",
                                        "label": "Sydney"
                                    }
                                ]
                            }
                        },
...

You may be able to add custom endpoints to this file following the pattern shown, but I recommend contacting the app developer directly to confirm. You can find their email address on the contact tab of other apps they've developed: https://splunkbase.splunk.com/apps?author=lgodoy

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...