All Apps and Add-ons

The rule FIELDALIAS is wrong in the Splunk app for Check Point

ckurtz
Path Finder

The props.conf FIELDALIAS for the field "rule" is bad, in both in [opsec] and [opsec:vpn]: (at least for v77 Firewalls)

FIELDALIAS-rule_for_opsec      = policy_name as rule

This overwrites the default key=value field for the "rule" field, a numeric field in the data. In an ideal world we could get a rule # to rule name definition from the Firewalls in some lookup table, but most CP Admins know their rule #s pretty well...

0 Karma
1 Solution

ckurtz
Path Finder

The temporary fix (until the app is updated) is to add the following to a local/props.conf file:

[opsec]
FIELDALIAS-rule_for_opsec      = 
[opsec:vpn]
FIELDALIAS-rule_for_opsec      = 

H/T to Fellow SplunkTrustee @dshpritz for the FIELDALIAS kung foo!

View solution in original post

ckurtz
Path Finder

The temporary fix (until the app is updated) is to add the following to a local/props.conf file:

[opsec]
FIELDALIAS-rule_for_opsec      = 
[opsec:vpn]
FIELDALIAS-rule_for_opsec      = 

H/T to Fellow SplunkTrustee @dshpritz for the FIELDALIAS kung foo!

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...