Splunk_OPSEC_TA: how can I pull the OPSEC .p12 cert from the Check Point management server without having to use Splunk web? Are there any command line tool?

[jbsplunk]

I've disabled SplunkWeb on my indexers and don't really want to re-enable it just to perform this function. Is there a workaround?

[Chubbybunny · Accepted solution]

this might help JB: '/opt/splunk/bin/splunk cmd ./pull-cert.sh'

for example:

[root@JAMES bin]# /opt/splunk/bin/splunk cmd ./pull-cert.sh 10.160.31.126 Splunk_JAMES support1 Splunk_JAMES_CERT_P12

The full entity sic name is:
CN=Splunk_JAMES,O=SENTINEL-ONE_Management_Server..fxugme
Certificate was created successfully and written to "../certs/Splunk_JAMES_CERT_P12".

by invoking the Splunk 'cmd' command, you can run the 'pull-cert.sh' directly.

invoke the command in the 'Splunk_TA_opseclea_linux22/bin' directory and include (in Order) the IP address of the Check Point management server, OPSEC Application name, OPSEC Application password, and CERT name.

(\__/)
(='.'=)
(")_(")