All Apps and Add-ons

MISP42Splunk accessing remote MISP instance with a client certificate

nick25
New Member

I'm trying to access a MISP instance from the MISP42Splunk App. I've configured the correct API key and MISP Base URL. I do not however, see an option to specify a client certificate to be presented to the MISP server and i think that breaks the integration. Do you know if there is an option to specify a client cert in MISP42Splunk or some other means?

Thanks.

0 Karma

remiseguy
New Member

Hi,
This is not available yet. Could you open an issue on github to get it implemented

0 Karma

remiseguy
New Member

Please check version 2.2.0 on github as I don’t have a lab set up yet to test it

0 Karma

nick25
New Member

Thanks a million Remi. MISP42Splunk 2.2.0 works on Windows 10.

Manually deleted the MISP42splunk folder in the Splunk /etc folder . Reinstalled MISP42Splunk using "install App from file" option. Restarted Splunk.

Specified the Client certificate as .PEM file, the same format as usually presented via the MISP API.

Ran reports on the dashboard and saw event data being successfully captured from the MISP instance.

Thanks for the prompt action.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...