All Apps and Add-ons

PAVO Getwatchlist Add-on - Enhancement request - allow watchlists to be disabled

chris_barrett
Communicator

I'd like to disable the default watchlists (default/getwatchlist.conf) as my client's system is air-gapped and instead use some internally sourced lists. 

I've looked at the SPEC file for getwatchlist.conf (README/getwatchlist.conf.spec) and there's no mention of a "disabled" setting. Nor is there any refenced to a disabled setting within the command's sourcecode (bin/getwatchlist.py).

The simple workaround is to just delete the default/getwatchlist.conf but my preference would be to have a local/getwatchlist.conf in which I can sets disabled=true for each of the default watchlist stanzas and then add in my own stanzas.

Labels (1)
0 Karma
1 Solution

aplura_llc_supp
Path Finder

getwatchlist.conf is a configuration only file. Meaning, getwatchlist (the command) won't use the configurations in the file unless a search is crafted to use it. They are "static" and so will not reach out to collect the information unless a saved search, SPL adhoc search, or some other "type of active search" triggers a read from the file. A "disable" option could be done, however, since the configs aren't used unless a search command is run, it doesn't make sense to disable it. It's not actively running unless told to do so via SPL. I hope this clarifies it a bit. Thanks!

View solution in original post

0 Karma

aplura_llc_supp
Path Finder

getwatchlist.conf is a configuration only file. Meaning, getwatchlist (the command) won't use the configurations in the file unless a search is crafted to use it. They are "static" and so will not reach out to collect the information unless a saved search, SPL adhoc search, or some other "type of active search" triggers a read from the file. A "disable" option could be done, however, since the configs aren't used unless a search command is run, it doesn't make sense to disable it. It's not actively running unless told to do so via SPL. I hope this clarifies it a bit. Thanks!

0 Karma

bsanjeeva
Explorer

@aplura_llc_supp , We had used Getwatchlist add-on on on-premise environment. Recently we have migrated to cloud. However, this add-on does not have supporting version for Cloud 8.2X. Is there an add-on that supports this version of cloud?

Tags (2)
0 Karma

aplura_llc_supp
Path Finder

We are working on a release for Cloud. Stay tuned, thanks!

0 Karma

chris_barrett
Communicator

I saw the URLs referenced in the logs and assumed that it was trying to reach out to them but it was presumably just during initialisation/start-up.

One advantage of having the ability to disable the stanzas would be that I, as the administrator, can prevent someone from even trying to use them as the Splunk environment in question won't be able to connect to them as it's air-gapped. 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...