All Apps and Add-ons

Why are the logs are not being collected in CB Protection App for Splunk?

hjf_bsingh
Explorer
1. Configured CB Protection application to export logs.
2. Installed CB Protection App on the Splunk Server.
3. Installed CB Protection App on all the Indexers. 
4. Installed UF and CB Protection App on the CB Protection Server 
    a. Configured the App to forward logs. 
    b. Checked logs on CB Protection server in /var/log/splunk/splunkd.log 
08-08-2018 08:11:33.776 -0400 INFO  TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997, pset=0, reuse=0.
08-08-2018 08:12:33.744 -0400 INFO  TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997, pset=0, reuse=0.
08-08-2018 08:13:03.448 -0400 INFO  TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997, pset=0, reuse=0.
0 Karma
1 Solution

hjf_bsingh
Explorer

Figured it out, The Splunk App on the CB Protection server was placed under a folder "cb-protection-app-for-splunk_20", it should been "bit9-secapp".

View solution in original post

0 Karma

hjf_bsingh
Explorer

I don't know when the new version is coming out but the current version version works with Splunk 7.2.1.

0 Karma

johnward4
Communicator

@carbonblack when is a new version of this app being released that's compatible with Splunk Enterprise 7.x*?

0 Karma

johnward4
Communicator

Does anyone know if this app works with Splunk Enterprise 7.x*?

0 Karma

hjf_bsingh
Explorer

Figured it out, The Splunk App on the CB Protection server was placed under a folder "cb-protection-app-for-splunk_20", it should been "bit9-secapp".

0 Karma

hjf_bsingh
Explorer

There is no customization of source type or index.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...