About lakshman239

lakshman239 · ‎03-21-2018

You can go to permissions [ via Manage Apps and selecting the estreamer app] and give read/write permissions to required roles and 'tick' All Apps under 'sharing for config file-only objects. This will make all knowledge objects global and ES and search app will be able to use it. Also, if you want ES to specifically use it, you need to update etc/apps/SplunkEnterpriseSecuritySuite/local inputs.conf's regex to include "eStreamer"

lakshman239 · ‎03-21-2018

Have you checked https://splunkbase.splunk.com/app/3663 app? This provides the UI/dashboards/reports. If you are collecting the data via syslog [ has limited data as opposed to using add-on's https://splunkbase.splunk.com/app/3662/ OR https://splunkbase.splunk.com/app/1629], you may be able to rename/adjust the sourcetype for the 3663 app to analyse the data and report/dashboard it. Just a thought

lakshman239 · ‎03-08-2018

I assume both 'tstats' in your search works independently. Are you missing "search" and minor change ? | tstats count from datamodel=A where nodename=B | search [|tstats dc(Fusion.BusinessIdentifier) as "Fusion" from datamodel=A where nodename=C by Fusion.BusinessIdentifier|return Fusion.BusinessIdentifier]|stats min(_time) as E by Fusion.BusinessIdentifier

lakshman239 · ‎03-08-2018

yes, you can override in transforms.conf with the values you want or you can use a regex to extract from the event. [yoursourcetype] REGEX = (.+) DEST_KEY = MetaData:Host FORMAT = host:my_host

lakshman239 · ‎03-08-2018

Thanks Kyle.

lakshman239 · ‎03-06-2018

I believe Add-on builder uses the naming convention of using ":", e.g. vendor:mysourcetype, so it could complain. ] In your props.conf, you could try something like to force to use rename [ not a good practice] [access:combined] rename = access_combined

lakshman239 · ‎03-06-2018

Greetings I am using the latest version of add-on builder (2.2.0) and can create an alert action/adaptive response action for ES with setup page. it works fine, but noticed that the default/setup.xml file is not present. Is this not needed anymore or do we need to manually create this? There is no info about this in the add-on builder documentation. Do we need to create setup.xml manually or is this no more needed? Thanks laks

lakshman239 · ‎02-21-2018

unfortunately, the AOB didn't package them on to default, overwritting the old version of alert_actions.conf.

lakshman239 · ‎02-21-2018

All the logs generated by add-on builder is available at /opt/splunk/var/log/splunk folder. splunk_app_addon-builder_ta_builder.log splunk_app_addon-builder_validation_engine.log splunk_app_addon-builder_ta_builder_validation.log You can search using index=_internal sourcetype="splunk:tabuilder:log" have you checked the Splunk_SA_CIM is at a version compatible with the version of your add-on builder?

lakshman239 · ‎02-21-2018

When we develop a TA using add-on builder and then update the alert actions, as part of packaging/merging, the add-on builder doesn't merge the local/alert_actions.conf to default, causing this issue. possibly its a bug in add-on builder?

lakshman239 · ‎01-24-2018

Hope you have seen these docs. http://downloads.sophos.com/readmes/srlw_51_rneng.html and http://docs.splunk.com/Documentation/AddOns/released/Sophos/ConfigureSophosEnterprise . If you have pulled the files to the server where Splunk UF and TA is installed, I would configure the local/inputs.conf with all the above enabled and point to your files as appropriate in dev and and adjust/change as needed. we generally look at threat data.

lakshman239 · ‎09-06-2017

can you confirm if you have used token.0.replacementType = timestamp stanza which covers all possible timeformats available in your multi-line event data? Also, if you are in app, say myapps with your sample file, mysample.csv, you can run to check the actual error ( should also be in splunkd.log) /opt/splunk/etc/apps/myapps/samples$ /opt/splunk/bin/python ../../eventgen/bin/eventgen.py -v -s mysample.csv ../local/eventgen.conf

lakshman239 · ‎08-23-2017

If you use the Splunk TA builder for your application ( i.e. oracle webLogic), it handles log rotation automatically using splunk internal log rotation libs. You may want to check that.

lakshman239 · ‎08-15-2017

Thanks for the comment. The TA is supported in distributed deployments, but cannot be run on its own in an SHC instance as the modular input calls qualys API and uses checkpoint to pull incremental data. So, only option at the moment is to deploy the TA on a dedicated splunk instance to pull the data (vulnerability / WAS) and forward to indexing tier for searches. However, the KB can possibly work in the SHC as it doesn't make a rest call to qualys API server.

lakshman239 · ‎08-09-2017

Answering my questions. For any fields to be available and visible in the incident review screens, it needs to be in /etc/apps/SA-ThreatIntelligence/default/log_review.conf. In the above case, fields like src_user_first, src_user_last are not present and hence they weren't available. So, if we add them in the local/log_review.conf or via GUI (Configure->Incident Management->Incident Review Settings), it works.

lakshman239 · ‎08-08-2017

Greetings we have the following versions : Splunk 6.5.2/ES 4.5.0/CIM 4.6.0 When we use the macro on its own in the search, it links and shows expected results. Also, when we use the same correlation search on the search bar [ within ES or general search], it works. However, as part of notable event, it doesn't link to identity and doesn't display the user_first, user_last etc.. Has anyone seen the following issue with the macro? Any pointers? | makeresults | eval user="VanHelsing" | get_identity4events(user) - works |datamodel(...) | get_identity4events(user) --works | .... in correlation search /notable doesn't display all the fields from the identity for that particular user. Thanks Laks

lakshman239 · ‎07-20-2017

We noticed a few issues with the Qualys 1.1 version and submitted a case with Qualys support. Suggest you raise a case with them

lakshman239 · ‎07-13-2017

I assume you are following the 'qualys-TA-for-splunk-enterprise-quick-start.pdf' documentation in https://community.qualys.com/docs/DOC-4876 page and successfully installed and configured version 1.1.0 in dev instance but getting errors in production install on a HF. I assume the splunk and OS versions (linux) are same in both dev and prod. Can you try the following in the prod HF? 1. install the add-on. Don't configure yet. 2. restart splunk. 3. confgure the add-on and provide credentials etc.. 4. restart the splunk. 5. check the logs in 'splunkd' and ta-Qua* and the index to which you are getting/pushing the data. Let me know how it goes.

lakshman239 · ‎07-12-2017

@Prabas - is the latest version of the TA 1.1.0 supported on SHC? It throws similar errors.

lakshman239 · ‎07-12-2017

The above indicates its unable to get the credentials from the 'passwords.conf' file OR possible corruption in the 'uninstall process'. 1.A clean way would be to stop the Splunk process on the heavy forwarder. Ensure no other process is running under 'splunk' user ( i.e. the user used to run the splunkd). rm the TA-QualysCloudPlatform directory from /opt/splunk/etc/apps folder. Re-install the new version required from GUI or placing the tar file under etc/apps and untar and restart/ re-config the add-on from GUI and restart splunk. Hope this helps.

Posts	655
Solutions	70
Karma Given	14
Karma Received	60
Member Since	‎07-05-2016

Online Status	Offline
Date Last Visited	‎09-09-2022 12:22 PM

Can whitespaces be trimmed when using lookup edito...

Url parser - logs doesn't rotate

Update default/props.conf with TA-eStreamer

Splunk Add on for PA - incorrect tagging of Networ...

Metrics definition errors in the add-on - is fix a...

Can you help me with an issue using macros and inp...

eStreamer logs from Active - Passive Sourcefire se...

Why doesn't splencore.sh with clean up doesn't wor...

Why do I see a script error when then the data is ...

why do we not have setup.xml in add-on's created b...

Re: Why eStreamer data from sourcefire is not gett...

Re: Can Splunk eStreamer app be used to view Cisco...

Re: I am using subsearch and trying to pass ID fro...

Re: Why am I seeing duplicate field values under i...

Re: why do we not have setup.xml in add-on's creat...

Re: Splunk add-on Builder: Why does the add-on com...

why do we not have setup.xml in add-on's created b...

Re: Splunk Enterprise Security: Adaptive Response ...

Re: Addon Builder CIM mapping

Re: Splunk Enterprise Security: Adaptive Response ...

Re: Sophos Reporting Interface and choosing the co...

Re: How to use Eventgen for multiline logs?

Re: What changes should I make to control the file...

Re: Qualys TA : setting up in SHC

Re: Splunk ES : macro get_identity4events not retu...

Splunk ES : macro get_identity4events not returnin...

Re: Unable to install Qualys technology add-on (TA...

Re: Unable to install Qualys technology add-on (TA...

Re: TA and VM apps for SHcluster and Indexer Clust...

Re: Unable to install Qualys technology add-on (TA...