Getting Data In

Splunk add on for Cyber Ark flawed?

burnalting
Explorer

Looking at the Splunk add on for Cyber Ark, it appears the process is flawed in that

  • the Cyber Ark supplied ./Syslog/RFC5424Changes.xsl fragment generates a syslog timestamp from the first syslog/audit_record/IsoTimestamp
  •  but the code in forExport/SplunkCIM.xsl then generates multiple CEF-like events on a 'single line' for, the possibly multiple, audit_record's and hold no timestamps

Thus if the XSLT iterates over more than one event, not only do the timestamps for the individual events get discarded, one possibly ends up with a single CEF like event with multiple key value pairs where the keys are repeated.

Basically it appears that multiple Cyber Ark events are concatenated together into one syslog record without any clear form of event separation and the timestamps for the 2nd and subsequent events are lost.

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...