About mmoermans

mmoermans · ‎03-14-2018

When using Enterprise Security we get the following error "Failed to find the target event with valid host and source values" after clicking on Show Source in a notable event. Does anyone know what's causing this error?

mmoermans · ‎03-09-2018

Does the CISCO ACI Add-on support the latest 3.x version of CISCO APIC? The addon says the following: • APIC system running 1.1(4e), 2.0(x), 2.1(1h) and 2.1(1i) Version I'm wondering if we can still use the add-on with an upgrade to the latest APIC version.

mmoermans · ‎02-01-2018

We've been noticing a high CPU use on a windows splunk forwarder that only has a simple monitor statement. The following monitor is used: --inputs.conf [monitor://\server\data$\LogDir*.log] disabled = false index = dataindex sourcetype = datatype With a few date.log files to monitor and the correct output to the indexers. Does anyone know what the cause might be for the high CPU? The _internal logs show nothing of interest.

mmoermans · ‎01-17-2018

On our heavy forwarder with the Splunk Add-on for Check Point OPSEC LEA one of the connections to the firewall is always on 95%+, the logging of the firewall behind that connection is also behind between 5-30 minutes during the day (slowly lags behind further during the day). Is there a way to make the python script for the LEA loggrabber to use more than 1 CPU or another way to fix the logging going behind so far? Thanks in advance for responses.

mmoermans · ‎11-27-2017

It's checkpoint logging on a heavy forwarder which grabs the logs through a python script called lealoggrabber, which makes it hard to tail the logging. Thruput in limits.conf is set to 10MB and the specific queues have been increased as well (were on 500kbs, were increased to 20MB since they showed blocked=true). 11-27-2017 15:35:49.756 +0100 INFO Metrics - group=queue, name=parsingqueue, blocked=true, max_size_kb=20480, current_size_kb=20479, current_size=32086, largest_size=32086, smallest_size=0 11-27-2017 15:35:49.756 +0100 INFO Metrics - group=queue, name=indexqueue, blocked=true, max_size_kb=20480, current_size_kb=20479, current_size=19334, largest_size=19334, smallest_size=0 The machine itself shows use of 40-50% CPU and memory use is about 30% on it. If you chart out the delay it shows a delay of almost 2 hours during the day and it catches up during the evening / weekends. It's about 200 GB / day worth of logging.

mmoermans · ‎11-23-2017

During the day one specific type of logging seems to lag behind quite a lot. From 10 minutes behind at the start of the day to 90m towards the end. It's logging from a heavy forwarder (Checkpoint logging) where two hosts are coming from the same heavyfowarder, but one lags behind and the other one isn't: 11-23-2017 16:07:02.058 +0100 INFO Metrics - group=per_host_thruput, series="host1", kbps=160.766222, eps=154.383526, kb=4983.868164, ev=4786, avg_age=0.820727, max_age=2 11-23-2017 16:07:02.058 +0100 INFO Metrics - group=per_host_thruput, series="host2", kbps=519.186108, eps=509.020485, kb=16095.141602, ev=15780, avg_age=4667.346071, max_age=5139 What can we do to determine what's causing the lag? The Heavy Forwarder is running fine and the Indexers aren't the issue either.

mmoermans · ‎11-16-2017

I'm trying to show a simple Yes (green) / No (red) on a dashboard based on a host not reporting for longer than 5 minutes. Seems to be a bit harder than I expected. What I've got: index=index host=host | stats latest(_time) as last_seen | eval duration_since = tostring(now() - last_seen, "duration") | eval stringtime=if(duration > "00:05:00", "Yes", "No") | table stringtime But this shows "No" at all times, even though the host reported 1 second ago. What am I doing wrong?

mmoermans · ‎11-16-2017

Ever since the upgrade to R80 the logs from OPSEC LEA app have been behind by about an hour (ranging from 30m to 90m through out the day), what can be the cause of this? Before they were always perfectly indexed within seconds. The opseclea:log:modinput logs don't show any errors so it's hard to pinpoint the issue.

mmoermans · ‎11-03-2017

Solved by making a copy of Splunk_TA_Windows called Splunk_TA_Vindows (Using the letter V since it's earlier in alphabet and would take precedent) and disabling wineventlog:security in it, pushing that to the forwarder. Even though I had removed the client from the Serverclass for windows eventlog it hadn't removed the app for some reason and only stopped after pushing a new app (Splunk_TA_Vindows) above it which disabled the winsecurity logging. Seems to be a bug for forwarders on 6.3.1., best fix would be to update the forwarder but wasn't possible in this case.

mmoermans · ‎11-02-2017

A strange issue is happening, a few of our forwarders are sending a massive amount of data (wineventlog:security) to Splunk. I've tried to remove the Windows_TA_Splunk from the forwarders but they keep sending their eventlogs regardless. I've tried restarting them several times but they don't stop sending data even though they don't have any received apps. Anyone know how to make them stop sending the wineventlog?

mmoermans · ‎10-02-2017

We're trying to add a new Forwarder (6.6.1) to our indexer (non-SSL connection), we're able to connect to the forwarder just fine and everything seems correct but we're not seeing the forwarder on the deployment server. In Splunkd.log we see the following error for the forwarder: WARN HttpListener - Socket error from x.x.x.x while idling: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher What can be the cause of this error?

mmoermans · ‎08-28-2017

Am I doing something wrong with the following search?: | tstats `summariesonly` count from datamodel=Network_Traffic where host=firewall AND block=Block1 by All_Traffic.action | eval block=if(date_hour>6 AND date_hour<20,"Block1","Block2")

mmoermans · ‎08-28-2017

Hi there, I'm trying to get a chart of total firewall connections dropped (action=dropped) from the checkpoint firewall of the last 14 days but in two blocks of time: one between 07:00 – 19:00 (7am-7pm) and one between 19:00 – 07:00 (7pm-7am) and then a mediaan of both of the two weeks. This in a datamodel (network traffic) so the general date_hour>=7 doesn't seem to work. How do I search for those two blocks of time in my query over 2 weeks?

mmoermans · ‎08-03-2017

Due to the lea_loggrabber script malfunctioning (reason unkown, not to be found in logging) we are missing 4 days worth of checkpoint logging. A restart of the heavy forwarder fixed the issue. What's the best practice for reading those 4 days worth of binary files back into Splunk through the OPSEC LEA process? A monitor doesn't seem to work from inputs.config. Second question: How can you create a backup for the OPSEC LEA process so that if it fails (like happened) another Heavy Forwarder can pick it up and input the data instead?

mmoermans · ‎07-24-2017

srchIndexesAllowed only lets you definine which indexes can be searched. If srchIndexesAllowed is empty then no results are found by Monitor user (in dashboards too). [role_monitor] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 importRoles = user_no_index srchIndexesAllowed = network srchIndexesDefault = network srchMaxTime = 0

mmoermans · ‎07-24-2017

Hi there, I'm trying to set up a monitor/manager account which only has access to dashboards but cannot search through indexes himself. Where do you set this permission?

mmoermans · ‎07-13-2017

The following search : | tstats summariesonly=t count from datamodel=Network_Traffic Results in no results, even when giving the user permissions to all indexes. The only way to give results is to add the "User" role. Why can't I give a custom role access to search this datamodel? The datamodel is global and so is the CIM app so I am confused why this doesn't work.

mmoermans · ‎07-12-2017

For security reasons there's users we don't want to give access to network indexes, yet they still need to view some things. So in order to allow users to search for specific things we're trying to set up a dashboard which uses the Network_Traffic datamodel and shows results. Yet whatever permissions I set none work for the user to view the datamodel results (No access to index, read rights to datamodel). How do you set this up?

mmoermans · ‎07-12-2017

Fixed it by editing the assets.csv in the monitoring console app. The "Apply Changes" fix might work as well (see above).

mmoermans · ‎07-11-2017

Our Monitoring Console on the DMC/License Master shows the Search Head as down in Topology and in Overview. When clicking further it shows as Up on some of the other screens but not all panels are filled in Resource monitoring / performance of the SH server. The search head runs just fine and is sending license information through to the LM. No errors occur in the Splunk logs that show an issue. What could be the issue?

mmoermans · ‎07-07-2017

The user role has permission to indexes for other actual ES users, which would mean the roles myuser and monitor would get access to search those indexes too though?

mmoermans · ‎07-07-2017

I've set up a new Role & User called monitor for the task of displaying Enterprise Security dashboards on a monitor/screen in the building. It's important that this account cannot search through indexes normally and embedding panels is out of the question as well. So I've copied the normal ES user permissions, made sure that the datamodel permissions are global same as field extractions etc. Yet somehow most of the panels in ES give "No results found." for the Monitor role unless I add the User role under Inheritance. I've tried giving the role every index and every capability yet still "No results found" unless I let it inhereit the user (which does not have any different capabilities). Am I missing a permission setting somewhere that I'm unaware of?

mmoermans · ‎07-04-2017

When there's a huge influx of incoming logging of blocked attempts on the firewall from one specific (external) source, is it possible to (temporarily) decrease/disable the amount of logging being received from this specific source so it doesn't flood our license when it's a known issue? Thanks in advance for the response

mmoermans · ‎02-02-2017

Those seem to change the inside of the map layouts for a choropleth map or the boundries of the zoom. I'm looking to display a geostats map report on a large screen so ideally I'd change the XML background of the report which so far doesn't seem possible sadly, it seems like such a simple thing that should be possible.

mmoermans · ‎02-01-2017

When creating a report (for embedding purposes, using a dashboard is not viable) and using geostats to create a map, is it possible to change the size of the map somehow? There does not seem to be a XML edit or any other way to change the map size of the embedded iframe. Edit: I'm trying to display a geostats generated report on a large screen but the frame of the map doesn't seem to be changeable anywhere.

Posts	50
Solutions	4
Karma Given	6
Karma Received	10
Member Since	‎02-01-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to create table from large JSON data?

Internal Error 500 Splunk app setup

Breaking events JSON

Memory use datamodels

Threat intel not being added

ES - Threat Activity Search add Host field

In Splunk Enterprise Security, how come old threat...

What can cause an issue of a different time extrac...

Bogon list

SNMP metrics with collectd

Failed to find the target event with valid host an...

Cisco ACI Add-on for Splunk Enterprise support for...

High CPU usage on UF

OPSEC Python CPU usage

Re: Logging lagging behind

Logging lagging behind

Single value last time yes or no

OPSEC LEA R80 logging behind

Re: Forwarder won't stop forwarding

Forwarder won't stop forwarding

SSL error on non-SSL forwarder connection

Re: Search blocks of time (certain hours)

Search blocks of time (certain hours)

Checkpoint OPSEC LEA 4.1 manual log input and mult...

Re: Remove search ability users

Remove search ability users

Datamodel search permissions

Datamodel dashboard view access without index perm...

Re: Monitoring Console shows searchhead as down

Why does monitoring console show searchhead as dow...

Re: Dashboard permissions for on monitor/screen

Dashboard permissions for on monitor/screen

Reduce specific logging

Re: Is it possible to change the size of a Geostat...

Is it possible to change the size of a Geostats ma...

Join the Conversation