Facing issues ingesting required certificates data using certificate transparency addon.
Add-on used : https://splunkbase.splunk.com/app/4006/#/overview
Version: 1.3.1
We have added inputs where we see that our certificate logs would be there but it seems the addon is not capturing all the logs from that input.
We do not see any errors as well.
Query that we are using to check for our company related certificates is :
index=certificate sourcetype=ct:log LogEntryType=0 LeafCertificate.x509_extensions.subjectAltName{}=*company_domain_name*
| dedup LeafCertificate.serial | table LeafCertificate.x509_extensions.subjectAltName{}, LeafCertificate.validity.notbefore, LeafCertificate.validity.notafter source| rename LeafCertificate.x509_extensions.subjectAltName{} as LeafCertificate_Name LeafCertificate.validity.notbefore as Valid_From LeafCertificate.validity.notafter as Valid_Till source as Source
