All Apps and Add-ons

Why is the CIS Critical Security Controls app script exiting abnormally?

aperez_splunk
Splunk Employee
Splunk Employee

From: Travis L.
Date: Thursday, February 23, 2017 at 10:42 AM
To: Anthony Perez
Subject: CIS controls app issues

Good day,

I wanted to contact you to inquire as to whether there is a common issue, which I believe to be experiencing with the CIS Critical Security Controls app. I am getting several errors when the python scripts in /bin try to fire off, as you can see in the screenshot:
alt text

I am running Splunk 6.5.2, and using your newest version of the app, freshly installed from Splunkbase.

Thanks!

0 Karma

aperez_splunk
Splunk Employee
Splunk Employee

Hi Travis,

Thank you very much for the outreach on this.

At first glance, it looks like the threat info/intel downloader scripts are all failing.

This most often occurs when the instance of python installed on the search head that the CIS app is installed on is located in a non-standard location.

As a first check:

  1. Navigate to the $SPLUNK_HOME/etc/apps/cis-controls-app-for-splunk/bin/ directory
  2. Check the path variable (e.g., python_bin = '/usr/bin/python') specified in one of the scripts throwing an error
  3. Verify that your search head has an instance of python in that location
  4. If python is NOT installed in that location, update the script to point to the location where python is installed on the search head
  5. Post an update for us here and I'll reconnect with you for next steps (or give you a virtual high-five for getting it fixed)

Separately, I've created an action to update this aspect of the download scripts in the next iteration of the app to make it a little more robust. Unfortunately the next rev probably won't be ready to publish until the end of April/beginning of May 2017.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...