Security

PKI and Splunk: Pulling Certificate Attributes

itsmevic
Communicator

What logs (if any) would contain the anatomy of a Certificate? In particular the "Valid from", "Issued to", "Issued by" and "Certification status" attributes?

0 Karma

wmyersas
Builder

What certificate(s) are you trying to get details on?

From what source(s)?

Are you collecting them from any inputs.conf anywhere?

0 Karma

itsmevic
Communicator

Hi, thanks for responding wmyersas. My question is more centered around whether or not there are logs that would produce those fields within the certificate itself that I could pull into Splunk?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...