Splunk Enterprise Security

Is CCURE add-on compatible with CCURE 9000

bhaskarasplunk
Explorer

Is CCURE add-on compatible with CCURE 9000

0 Karma

gfisbeck
Explorer

@richardphung:

Would you mind sharing your DB query? I'm looking to set this up and am curious to know what you used...

0 Karma

GOB_Bluth
Explorer

I'm also interested in the query if anyone has something to start with.

0 Karma

richardphung
Communicator

We use this app with CCURE9000.
It kind of depends on your DB Query whether the built-in extracts are going to work for you,... but it isn't hard to customize.

0 Karma

NuHarborMatt
New Member

Hey sorry for the late response,

I'm not too sure if it will or not. When it was created i built it off of a different version for certain. IF the log syntax is similar enough to that of the Redacted Log Sample below, I'd say you're in good shape for it to work.

Redacted Log Sample
2018-12-20 13:29:58.000, MessageUTC="2018-12-20 18:29:58.0", MessageType="CardAdmitted", PrimaryObjectName="liechtenstein, ulrich", PrimaryObjectIdentity="AA11A11A-AA11-11AA-A1A1-AAAAAA111111", SecondaryObjectName="potentially the name of entrance area", SecondaryObjectIdentity="B2B2B2B2-BB22-22BB-B2B2-BBBBBB22222", XmlMessage="InDirection12345AdmitAdmitliechtenstein, ulrichpotentially the name of entrance area"

In the event your logs differ. You could send over redacted log samples of the 9000 product and i could update the add-on and get it out with the new release.

0 Karma

kpkeimig
Explorer

did you try it?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...