McAfee DAM offers the ability to detect suspicious/malicious queries by monitoring them on the host itself with an agent that reads running queries from memory. It is also able to block (after a race condition, letting some data through) and quarantine malicious use/users of the system. Typical out-of-the-box rules include detection of tricky SQL injection activity, privilege escalation, and other generic and platform-specific exploits. In addition, this product also includes a scanning modules that, which I'll consider outside the scope of the question unless I hear otherwise. As for the ability to detect malicious activity against databases in real time - YES, Splunk can do much of this. Take a look at the following apps: DB Connect - https://splunkbase.splunk.com/app/2686/ This can be used to pull data from tables in nearly any JDBC-accessible database platform, including audit tables that would let you examine queries for malicious activity. Oracle Add-On - https://splunkbase.splunk.com/app/1910/ Includes a number of very useful queries for monitoring user activity, works with DB Connect MS SQL Add-On - https://splunkbase.splunk.com/app/2648/ Includes a number of very useful queries for monitoring user activity, works with DB Connect Splunk App for Stream - https://splunkbase.splunk.com/app/1809/ Provides an alternative to DB Connect for monitoring queries by allowing you to pull query strings off the network as decoded wire data. It can even decrypt encrypted traffic if you can provide the private key. SQL Injection Search - https://splunkbase.splunk.com/app/1528/ Provides some ability to detect malicious data in SQL strings. This page also has advice for other methods to detect it. Now, for most of these apps above, you will need to research and produce a lot of the "content," i.e. Splunk search intelligence to detect the malicious behavior you are trying to detect. With McAfee DAM, part of the value prop is that they provide the rules and content. That said, you will find a LOT of good advice on how to detect malicious activity in SQL query strings out there, which you can directly apply to Splunk search and tailor to your specific environment. Here are a couple of Splunk blogs on the subject, but Google for this generically and you'll find lots more: http://blogs.splunk.com/tag/sql-injection/ In terms of blocking this activity, the vast majority of McAfee DAM users do not enable this. If you actually want to do this with Splunk, you should look into creating a custom alert action and leverage your DB platform(s) API or other scripted method. As with McAfee, you will likely find yourself in a race condition under the best of circumstances. Good luck! ... View more

There is a known bug with IE 9 that is resolved in 6.2.6. If you can upgrade and try it out, that might solve the problem. ... View more

If it's only cisco:asa coming in on UDP 514, simply change the line in the inputs.conf to sourcetype=cisco:asa. The better way to do this, however, is to run a syslog server separate from Splunk (e.g. rsyslog or syslog-ng). Configure this server to receive all the syslog and write it out to local disk. When it writes it, it should use the IP or DNS name of the sending device as the directory name to which it writes the events. Then you can use a Splunk monitor (file) input (using a Universal Forwarder if not doing this on the Splunk server) to pick up the file. You can configure the host_segment parameter to pick up the "host" value from the path to the file (e.g. /var/syslog/host1 /var/syslog/host2 would pick up the 3rd segment of the path). If you have a mixed stream of syslog (i.e. not just ASA), and you can't or won't run a separate syslog collector outside of the Splunk server itself, you would have to accept the data as syslog and then assign sourcetype based on source or other properties with the correct sourcetypes. Take a look here: http://blogs.splunk.com/2010/02/11/sourcetypes-gone-wild/ Hope this helps! -Andrew ... View more

You can try to untar the package into your $SPLUNK_HOME/etc/apps/ directory (should create its own sub directory) and restart Splunk. ... View more

Pipe results to an eval statement like eval delta_f = abs(delta_f) Which converts to absolute value ... View more