All Apps and Add-ons

Issue with Certificate transparency addon- Why isn't addon capturing all logs?

ss113
New Member

Facing issues ingesting required  certificates data using certificate transparency addon.

Add-on used : https://splunkbase.splunk.com/app/4006/#/overview

Version: 1.3.1

We have added inputs where we see that our certificate logs would be there but it seems the addon is not capturing all the logs from that input.

We do not see any errors as well. 

 

Query that we are using to check for our company related certificates is :

index=certificate sourcetype=ct:log LogEntryType=0 LeafCertificate.x509_extensions.subjectAltName{}=*company_domain_name*
| dedup LeafCertificate.serial | table LeafCertificate.x509_extensions.subjectAltName{}, LeafCertificate.validity.notbefore, LeafCertificate.validity.notafter source| rename LeafCertificate.x509_extensions.subjectAltName{} as LeafCertificate_Name LeafCertificate.validity.notbefore as Valid_From LeafCertificate.validity.notafter as Valid_Till source as Source

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...