Tanium decode base64 fields

All Apps and Add-ons

Hello, I am in the process of setting up integration with Tanium and I noticed that the payload is always base64 encoded. Is there a way either through Tanium or through Splunk to decode this field on the fly? If I have to parse this through Splunk I would need to extract the fields that are associated with the encoded string. Also, can this be done at index time or before hand if done by Splunk, maybe through a HF? Hoping someone has some experience with Tanium configurations specifically.

Thanks

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Reuse: Word-play

This puzzle series (first published here) is based on analysing words.Some of the statements in your puzzle ...

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...