Are you 100% sure no other service is bound to UDP port 514? Say you have Kiwi syslog server or something similar also installed on the server. ... View more

Bumping this. ... View more

Set up a dev env with the same amount of forwarders? I believe the OPs question is how to test the matching/non-matching of server classes, particularly in combination with continueMatching, not whether an app works or not. That scenario is well suited for a test env, but the one where you need to test the behaviour of Deployment Server as a whole is not suited for a test env. If only we could simulate N amount of forwarders with specific names/DNS entries/IP addresses/ClientNames... ... View more

Oh, yeah, if you logs ACLs you will actually get that as traffic data. It's even CIM compliant if you use the Cisco Networks App/Add-On. Check the Help page in the app for instructions on how to set up your logging correctly. Please rate/accept helpful answers 🙂 ... View more

Using syslog you'll only be able to monitor the state of the switches. None of the switches allow you to actually output traffic logs, but the Nexus 9k App and Add-on for Splunk will let you show interface statistics. I'm not sure how well this app works as I haven't used it, but give it a shot. https://splunkbase.splunk.com/app/1916 https://splunkbase.splunk.com/app/1897 Regards, Mikael Author of the Cisco Networks app ... View more

Check your Windows Firewall 🙂 And why is your Splunk server constantly pinging the Defense Center? ... View more

Hi, The AP selector will only show events for autonomous APs. In fact I haven't had the chance to test this myself. It is purely based on Cisco's reference log format for autonomous APs. In regard to Wireless the app could really need some extra attention as I do not work much with wireless myself. If you have any custom extracts or dashboards, please let me know and I'll consider adding them to the app. Regards, Mikael Author of the Cisco Networks App ... View more

We finally found a workaround. The loggrabber script never attempts to connect to port 18264 on the Checkpoint Server, but an strace revealed that it tries to open the CRL locally on the Splunk server from /etc/fw/conf/ICA.crl We configured a cron script that pulls an updated CRL list to this path. It now works. We are still stumbled when it comes to what changed on the Checkpoint server since this used to work before without the workaround. ... View more

Hi! Using your above solution but I end up with lots of copies of logs getting gzipped and suffixed, so it looks like it's gzipping what's already been gzipped and rotated, in a loop. Using the exact config you pasted. Is your config still working? ... View more

Since the add-on is CIM compliant you can use the Web data models in the Splunk Common Information Add-on (available at Splunkbase). Enterprise Security will also be able to leverage these logs out of the box. I guess top domains, top users, top user agents etc could be interesting data to show in your dashboard ... View more

Great! If you need this to be CIM compliant then get tags.conf from https://github.com/inspired/TA-Microsoft_Forefront_TMG/blob/master/default/tags.conf I believe it is missing in the app I posted on Splunkbase. If you don't need CIM then don't bother 🙂 Please also rate the app on Splunkbase if you find it useful ... View more

Yep,I ended up doing this and prefixing the src field with "Door_". Now I just need to populate all the asset lists. Blah! If anyone is interested in seeing an example implementation, it's available here: https://github.com/inspired/TA-Stanley-Access_Control ... View more

Hi, Do not enable acceleration on any Indexer. In general apps that have data models defined should not be deployed to Indexers Deploy apps/TAs with acceleration ONLY to Search Head Cluster Peers. The peers will make sure that the acceleration isn't done multiple times All Search Head Cluster Peers should be set up with an outputs.conf that forwards all data to indexers. This is very important, otherwise the accelerated Data Models will be local to each Search Head Cluster Peer. You can deploy this outputs.conf file through an app in the shcluster/apps folder. If you are building custom apps with your own DMs, make sure you split them into two apps. An "app" part with views, dashboards and the data model. The other is the TA (Technology Add-on) part which includes index time transforms and also field extractions. The first should only be deployed to Search Heads, the latter should reside on both Indexers and Search Heads. For an example, take a look at my Cisco Networks app and Cisco Networks Technology Add-on, available at Splunkbase. ... View more

Hi! It's proved to be difficult to get the right XML node because the format of all the Call Home events from different device types and even software versions differ. If you can paste the XML from the call home event for that device I can look into getting it fixed. Mikael ... View more

If you want to see both the host and sourcetype, try this instead: (source=cisco:ucs:faultInst “severe” and “error” ) OR (sourcetype=vmware:esxlog:vmkernel ) | strcat sourcetype "::" host sourcetype_and_host | timechart count by sourcetype_and_host ... View more

Hi kalifehj, any chance you could share the summary index search you created? I'm having the same issue, but would also like to make AMP events compliant with the CIM Malware data model. ... View more

You're right. The existing DMs should be good enough for now. Re-using saves a few CPU cycles and a lot of memory. If I come into a situation that requires its own model I'll let you know. There may be card reader specifics but that's not really my field so I can't think of a case that requires a DM on its own ... View more

I'm starting to think that something is seriously broken on the CP management server. As another test I compiled fw1-loggrabber from the latest code at github.com/certego and am seeing the exact same issue with the CRL. The port 16264 traffic is not seen in tcpdump at all. ... View more

Thanks. Perhaps the docs should be updated to reflect this? As of today the docs only say the following: "It has support for Exchange Server 2007, 2010, and 2013" ... View more

Now this is interesting! There is no traffic to TCP port 18264 at all, so it never tries to get the CRL using lea_loggrabber! I can get the CRL just fine using curl. Do you also see both a URI and a DN as your CRL distribution points? I'm wondering if it fails because of the DN (LDAP query)? ... View more

Verified that openssl can open the CRL from the Splunk server: Certificate Revocation List (CRL): Version 2 (0x1) Signature Algorithm: sha1WithRSAEncryption Issuer: /O=cpserver..abab9q Last Update: Sep 11 01:49:43 2016 GMT Next Update: Sep 18 01:49:43 2016 GMT CRL extensions: X509v3 Issuing Distrubution Point: critical Full Name: URI:http://cpserver:18264/ICA_CRL0.crl DirName: O = cpserver..abab9q, CN = ICA_CRL0 Revoked Certificates: Serial Number: 016000 Revocation Date: Aug 31 18:55:46 2007 GMT Serial Number: 016002 .... .... .... -----END X509 CRL----- So the problem doesn't seem to be fetching the CRL ... View more

That's what I first thought as well, but I had no trouble getting the CRL from that URL from the Splunk server, so the problem must lie somewhere else. Do you see the CPDIR and registry warnings in your logs too? Wondering if that's the culprit ... View more

R77.30. [opsec_logs] cert_name = opsec_logs_1496239478.p12 fw_version = R77 lea_app_name = SplunkLEA lea_server_auth_port = 18184 lea_server_auth_type = sslca lea_server_ip = 1.1.1.1 lea_server_type = primary opsec_entity_sic_name = CN=cp_mgmt,O=cpserver.example.com..abab9q opsec_sic_name = CN=SplunkLEA,O=cpserver.example.com..abab9q ... View more