Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About doksu
doksu
Contributor
Member since:
05-14-2013
03-21-2022
Community Statistics
| Posts | 117 |
| Solutions | 18 |
| Karma Given | 3 |
| Karma Received | 35 |
| Member Since | 05-14-2013 |
Activity Feed
- Got Karma for Re: Linux Secure Technology Add-On: auth.log not parsed. 11-01-2021 07:46 AM
- Got Karma for Re: Configuring SELinux on RHEL 6. 08-25-2021 06:42 AM
- Got Karma for Re: Configuring SELinux on RHEL 6. 08-25-2021 06:42 AM
- Posted Re: TA_netfilter - REGEX used by netfilter_flags transform breaks under certain conditions on All Apps and Add-ons. 01-21-2021 07:55 PM
- Got Karma for Re: Why does Linux Auditd App filter out root for the user lookup?. 12-02-2020 07:51 PM
- Posted Re: Why does Linux Auditd App filter out root for the user lookup? on Getting Data In. 12-02-2020 07:29 PM
- Posted Re: Deep Learning Toolkit for Splunk Container Security on All Apps and Add-ons. 09-09-2020 05:27 PM
- Tagged Deep Learning Toolkit for Splunk Container Security on All Apps and Add-ons. 09-09-2020 05:25 PM
- Posted Re: Any way to change the default owner of a notable dynamically? on Splunk Enterprise Security. 08-30-2020 04:12 PM
- Posted Re: Linux Secure Technology Add-On: Implications using Splunk_TA_nix simultaneously on All Apps and Add-ons. 08-18-2020 05:04 PM
- Got Karma for Re: Please cater for UFW in Auditd searches/reports. 06-05-2020 12:50 AM
- Got Karma for Re: Weird behavior of addon. 06-05-2020 12:50 AM
- Got Karma for Re: Feature Request: Track New SOFTWARE_UPDATE type (RPM audit events). 06-05-2020 12:50 AM
- Got Karma for Re: Please cater for UFW in Auditd searches/reports. 06-05-2020 12:50 AM
- Got Karma for Re: Linux Auditd app - Is the SPL for the Anomalous Event Volume panel broken?. 06-05-2020 12:50 AM
- Got Karma for Re: Linux Auditd app - Is the SPL for the Anomalous Event Volume panel broken?. 06-05-2020 12:50 AM
- Got Karma for Re: Possible bad example in TA_netfilter documentation?. 06-05-2020 12:50 AM
- Got Karma for Re: How do you conduct security monitoring in Linux?. 06-05-2020 12:49 AM
- Got Karma for Re: Splunk Add-on for Unix and Linux vs Linux Auditd. 06-05-2020 12:49 AM
- Got Karma for Re: Linux Secure Technology Add-On: auth.log not parsed. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
09-30-2016
06:33 PM
As per kungku71186's comments, please check out the installation and configuration instructions: https://github.com/doksu/splunk_auditd/wiki/Installation-and-Configuration as it sounds like there's a sourcetype issue.
The search you mentioned doesn't use a datamodel, however other searches in the Linux Auditd app use an "Auditd" datamodel provided by the TA_linux-auditd app. As per the documentation, no configuration of the datamodel is required, however acceleration is strongly recommended for performance reasons.
As an aside, the Common Information Model (CIM) app is not required.
... View more
08-24-2016
04:01 PM
Hi andylee53,
Is the Common Information Model app installed? It provides the drop_dm_object_name macro and Authentication datamodel the app uses.
Cheers,
Doksu
... View more
08-17-2016
05:41 PM
I updated the app to v2.0.3 more than two weeks ago, but it's still going though the certification process.
... View more
07-23-2016
03:11 AM
Hi stmcmahon, could you please provide the rationale given by the PMs for changing this functionality?
... View more
07-15-2016
04:00 AM
Hi stmcmahon, it's certainly a bug with core Splunk and not the app, but I do appreciate Abhi's raising the question because then other customers experiencing the issue after upgrading to Splunk 6.4.1 can discuss here. It's definitely not related to the app because the issue can be replicated by using the predict command against any dataset.
... View more
07-06-2016
06:40 PM
Any update from support?
... View more
06-26-2016
10:00 PM
This is caused by Enterprise Security's app import regex: https://github.com/doksu/splunk_auditd/wiki/Release-Notes#known-issues
I would suggest creating a local app_regex in the Enterprise Security app:
SplunkEnterpriseSecuritySuite/local/inputs.conf:
[app_imports_update://update_es]
app_regex = (appsbrowser)|(search)|([ST]A-.*)|(Splunk_[ST]A_.*)|(DA-ESS-.*)|(Splunk_DA-ESS_.*)|(TA_.*)
disabled = 0
Please see https://github.com/doksu/splunk_auditd/issues/11 for more discussion about the issue.
... View more
06-21-2016
08:09 PM
Which version of the TA_linux-auditd app is installed?
Which version of the CIM app is installed?
If you run the search: eventtype=auditd_events in "Smart Mode", do you see the normal list of fields on the left-hand side?
... View more
06-16-2016
05:23 AM
I've successfully replicated this on splunk-6.4.1-debde650d26e.x86_64, so it appears to be a bug in the predict command. Could you please open a support ticket with Splunk?
In the interim, you could add renames between the predict and eval commands like so:
... | rename upper(prediction) as upper | rename lower(prediction) as lower | ...
... View more
06-07-2016
10:52 PM
This won't apply to OSSEC events that have already been indexed. Once Splunk indexes events, they cannot be changed. If you need the historical events to be correctly sourcetyped, you'll need to manually re-index them.
The 'linux_audit' transform being used in the prop above is provided by the TA_linux-auditd app and it has a regex to identify auditd events.
... View more
06-07-2016
10:47 PM
Good to hear the sourcetyping worked. Would you mind accepting the answer and we can then discuss the host field issue in your new question (https://answers.splunk.com/answers/409734/unable-to-override-host-value-using-regex.html)?
... View more
05-03-2016
04:47 PM
Does this search environment have ES installed?
... View more
04-20-2016
07:13 PM
If the issue is related to the bro TA, its CIM tagged eventtypes use searches based upon bro sourcetypes and those sourcetypes are assigned dynamically at index-time based upon the name of the file being ingested. So if the bro events aren't ending up the datamodels you're expecting, there's two things to check: the index-time props/transforms for bro are on the indexers/heavy forwarders cooking your bro events and that the expected filenames (conn.log, bro.conn.log, md5.bro.conn.log, etc.) match the actual names of the files being ingested causing the events to be correctly sourcetyped.
Hope this helps, but it's quite difficult to diagnose without intimate knowledge of your environment. If you can't sort it out, I would certainly open a support case.
... View more
04-18-2016
04:11 PM
The Threat_Activity datamodel object used by that dashboard is constrained by: index=threat_activity
Could you please search index=threat_activity for all time to see if anything is in that index.
... View more
04-17-2016
04:29 PM
2 Karma
If the Threat datamodel hasn't completed acceleration, the Threat Activity dashboard is unlikely to show any/complete results because the tstats commands used to populate the panes only searches against summarised data by default.
... View more
03-31-2016
01:52 PM
You can disable the periodic update of auditd_indicies.csv by going to Settings -> Searches, reports, and alerts -> Change the 'App Context' dropdown to 'Linux Auditd Technology Add-On (TA_linux-auditd)' -> Click 'Disable' next to the 'Update auditd_indicies lookup' search.
In what way is the lookup being truncated? The saved search mentioned above uses this (| tstats values(sourcetype) as sourcetype where [|inputlookup auditd_sourcetypes] by index | table index | outputlookup auditd_indicies) to update the auditd_indicies.csv lookup every four hours. If the auditd_indicies.csv lookup is empty after this runs, I think the issue may be that there's a problem with auditd_sourcetypes.csv - have you modified it and if so could you please provide?
Here's an example of what an auditd_sourcetypes.csv should look like if you've modified it to support the vendor's old sourcetype naming convention:
sourcetype
linux:audit
linux_audit
... View more
03-29-2016
06:00 PM
There's a few questions there so I'll answer them one by one:
Yes, the TA must be installed and lookups populated on all search heads you wish to use with the Linux Auditd app
If I understand correctly, you don't have shell access to the search head and so can't run the awk command to populate the local posix user lookup? Don't worry too much if you can't for one reason or another populate the local and directory lookups, because version 2 of the app automatically learns your users. 🙂 I will update the documentation to clarify this point.
If you have multiple directories, you need to populate the directory posix user lookup with your posix users across them all. There are many ways to approach this but it depends entirely on your environment so I can't really comment on the specifics.
It sounds like uids are not consistent across your environment? This is undesirable to say the least and will likely cause issues for many reasons, not only the Linux Auditd app. Having said that, if the Linux Auditd app detects a uid conflict, it will resolve it by populating the user field with the uid. If you haven't already watched this video I'd recommend having a look: https://www.youtube.com/watch?v=M7QZRAHSs5E
... View more
03-26-2016
04:07 AM
I had the same issue when creating a correlation search in ES that pivots against a datamodel in a custom TA. I had to manually add the TA's name to the list of imported apps in '$SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/metadata/local.meta' so that the datamodel is "visible" to ES and then the correlation search could successfully pivot against it. If @frobinson_splunk has any suggestions in this case it would be much appreciated.
... View more
02-09-2016
07:04 PM
This command will tell you which app the indexes.conf _blocksignature stanza resides in:
/opt/splunk/bin/splunk btool --debug-print=app indexes list _blocksignature | head -1 | awk '{print $1}'
... View more
02-08-2016
03:33 PM
To search Splunk events in reverse order, you can use tstats on either indexed fields (i.e. index, host, source, sourcetype, or any other fields you choose to index) or a data model (which I'd suggest should be accelerated). The preferred approach is to use a data model, and add your "upgraded" field to the data model itself as an eval. In this way, when you search against the data model, it both searches in reverse and automatically calculates the value of "upgraded".
e.g.: | tstats values(upgraded) FROM datamodel=upgrade BY _time, host
... View more
02-04-2016
04:54 PM
The datamodel command does not take advantage of a datamodel's acceleration (but as mcronkrite pointed out above, it's useful for testing CIM mappings), whereas both the pivot and tstats command can use a datamodel's acceleration.
Other than the syntax, the primary difference between the pivot and tstats commands is that pivot is designed to be used only against datamodels and unlike tstats, doesn't require those datamodels to be accelerated (this is a big benefit for shipping app dashboards where you give the customer the choice of accelerating the datamodel or not - as should be done).
tstats is very useful for querying indexed fields outside the context of datamodel use (e.g. | tstats dc(host) WHERE index=* OR index=_* BY _time,index span=15m) and as seen in the example, can take an arbitrary time span aggregation.
The notion that one is better than the other misses the point. They are all useful, and depending on the use case, one may be better suited than another to a particular task. A ninja knows when it's best to use one over another.
... View more
01-05-2016
09:18 PM
Worked a treat, thanks.
... View more
01-03-2016
10:16 PM
How can a HiddenSearch (http://docs.splunk.com/Documentation/Splunk/6.2.1/AdvancedDev/PostProcess) be used in a Splunk 6.3 Simple XML dashboard?
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-21-2022
09:22 PM
|
Karma from
