Splunk Dev

Splunk python script trap issue

satkan100
Path Finder

IN my environment i am using python script to sent trap .please find the script below ...
Script is working fine using this i am able to generate the incident through tool.
For my concern is i have received only one source detail in the incident.
i need all the source details what ever available in the column need to sent in trap server .

Please help any one...

import os
import csv
import gzip
import subprocess
import shlex
os.chdir(os.path.dirname(__file__))

if __name__ == "__main__":
#Read the environment variables that Splunk has passed to us
                scriptName = os.environ['SPLUNK_ARG_0']
                numberEventsReturned = os.environ['SPLUNK_ARG_1']
                searchTerms = os.environ['SPLUNK_ARG_2']
                queryString = os.environ['SPLUNK_ARG_3']
                searchName = os.environ['SPLUNK_ARG_4']
                triggerReason = os.environ['SPLUNK_ARG_5']
                browserUrl = os.environ['SPLUNK_ARG_6']
                rawEventsFile = os.environ['SPLUNK_ARG_8']

#file where you want to write the content   
logFile = open('D:\Splunk\splunk_alert_events.txt', 'a')


#We got the file name from the envioenment vars
eventFile = csv.reader(gzip.open(rawEventsFile, 'rb'))

#logFile.write(eventFile)
i=0
for row in eventFile:
  if i==0:
   i+=1
  else:
   myhost=row[2]
   source=row[3]
   sourcetype=row[1]
   logFile.write(myhost + "\n")
   logFile.write(browserUrl + "\n")
   logFile.write(scriptName + "\n")
   logFile.write("queryString" + "\n")


logFile.close()

logFile = open('D:\Splunk\splunk_alert_trapsDC.txt', 'a')
proc = subprocess.Popen(['C:\Windows\System32\VivekB.exe','-d', '10.182.73.70','-v', '1.3.6.1.4.1.4842.200.1.0','STRING',myhost,'-v', '1.3.6.1.4.1.4842.200.1.1','STRING',source,'-v', '1.3.6.1.4.1.4842.200.1.2','STRING',browserUrl,'-v', '1.3.6.1.4.1.4842.200.1.3','STRING',sourcetype,'-v', '1.3.6.1.4.1.4842.200.1.4','STRING',scriptName,'-v', '1.3.6.1.4.1.4842.200.1.5','STRING',queryString,'-v', '1.3.6.1.4.1.4842.200.1.6','STRING',searchName,'-v', '1.3.6.1.4.1.4842.200.1.7','STRING',triggerReason],shell=False)
logFile.write(proc + "\n")
logFile.close()

logFile = open('D:\Splunk\splunk_alert_trapsDR.txt', 'a')
prog = subprocess.Popen(['C:\Windows\System32\VivekB.exe','-d', '10.182.73.164','-v', '1.3.6.1.4.1.4842.200.1.0','STRING',myhost,'-v', '1.3.6.1.4.1.4842.200.1.1','STRING',source,'-v', '1.3.6.1.4.1.4842.200.1.2','STRING',browserUrl,'-v', '1.3.6.1.4.1.4842.200.1.3','STRING',sourcetype,'-v', '1.3.6.1.4.1.4842.200.1.4','STRING',scriptName,'-v', '1.3.6.1.4.1.4842.200.1.5','STRING',queryString,'-v', '1.3.6.1.4.1.4842.200.1.6','STRING',searchName,'-v', '1.3.6.1.4.1.4842.200.1.7','STRING',triggerReason],shell=False)
logFile.write(prog + "\n")
logFile.close()
0 Karma

lakshman239
Influencer

Are you using Splunk Enterprise Security and referring to notables/incidents? is your python script is a modalert adaptive response based? Have you looked at using Add-on-Builder app to create your alert?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...