Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About JimWachhaus
JimWachhaus
Path Finder
Member since:
06-07-2011
06-05-2020
Community Statistics
| Posts | 32 |
| Solutions | 2 |
| Karma Given | 3 |
| Karma Received | 2 |
| Member Since | 06-07-2011 |
Activity Feed
- Karma Any Plan to Make Tripwire Enterprise App for Splunk Enterprise Splunk>Cloud Compatible for sstumpf_splunk. 06-05-2020 12:50 AM
- Got Karma for Re: Tripwire IP360 Add-on for Splunk error: "operator does not exist". 06-05-2020 12:49 AM
- Karma Re: Tripwire Enterprise App for Splunk Enterprise: Why are tags associated with event types not being applied? for gjanders. 06-05-2020 12:48 AM
- Karma Does it supports Splunk Cloud? for rnamini. 06-05-2020 12:47 AM
- Got Karma for Re: Tripwire Enterprise App for Splunk Enterprise: Why are there no TA_te add-ons included in the latest 153 build of the app?. 06-05-2020 12:47 AM
- Posted Re: Any Plan to Make Tripwire Enterprise App for Splunk Enterprise Splunk>Cloud Compatible on All Apps and Add-ons. 03-26-2019 10:11 AM
- Posted Re: Tripwire App on All Apps and Add-ons. 03-21-2019 12:59 PM
- Posted Re: Add - on Tripwire on All Apps and Add-ons. 03-21-2019 12:57 PM
- Posted Re: Tripwire App on All Apps and Add-ons. 02-25-2019 10:31 AM
- Posted Re: Tripwire App on All Apps and Add-ons. 02-23-2019 05:18 PM
- Posted Re: Tripwire App on All Apps and Add-ons. 02-22-2019 11:01 AM
- Posted Re: tripwire app for splunk controll data pulled on All Apps and Add-ons. 05-23-2018 09:10 AM
- Posted Re: tripwire app for splunk controll data pulled on All Apps and Add-ons. 05-16-2018 10:02 AM
- Posted Re: tripwire app for splunk controll data pulled on All Apps and Add-ons. 05-14-2018 12:41 PM
- Posted Re: Tripwire IP360 Add-on for Splunk error: "operator does not exist" on All Apps and Add-ons. 10-06-2017 01:14 PM
- Posted Re: Tripwire IP360 Add-on for Splunk error: "operator does not exist" on All Apps and Add-ons. 10-05-2017 01:39 PM
- Posted Re: IP360 addon not working on DBconnect v3 on All Apps and Add-ons. 10-05-2017 12:59 PM
- Posted Re: the question about Tripwire Enterprise App for Splunk Enterprise on All Apps and Add-ons. 10-05-2017 12:51 PM
- Posted Re: Tripwire Enterprise App for Splunk Enterprise: Why am I not able to see data in the app? on All Apps and Add-ons. 03-31-2017 11:27 AM
- Posted Re: Tripwire Enterprise App for Splunk Enterprise: Why am I not able to see data in the app? on All Apps and Add-ons. 03-31-2017 11:12 AM
Topics I've Started
No posts to display.
03-26-2019
10:11 AM
This is a great question and the answer is that we are looking at a total revamp of the apps/add-ons for both Tripwire Enterprise and IP360. We are building that with Splunk Cloud certification in mind.
... View more
02-25-2019
10:31 AM
After you log in what steps did you take to navigate to that?
Was it under settings or actions?
... View more
02-23-2019
05:18 PM
The Add-On defaults to TE Log Management which is TCP syslog on port 1468. How did you send logs?
... View more
02-22-2019
11:01 AM
Tripwire Enterprise (TE) has at least 3 means of providing syslog:
A syslog action is UDP/514 and can be configured for different syslog receivers. This will provide change information, file that changed, how it changed, what rule was used, and what system the change occurred on.
Log Management is TCP/1468 and provides logs of everything on the TE console including changes to configuration, logons, and audit events from the agents.
TE Event Sender is a utility added to a TE install to provide granular logging over TCP or UDP syslog on various events not included with the action or log management.
What option are we discussing?
... View more
05-23-2018
09:10 AM
The free app isn't designed to pull summary for test results, We do have a premium extension called Event Sender that would do this.
With regard to the connection issue, are you seeing failed authentication or anything of that sort in the TE logs for that? Also, could it be an intervening network or host firewall/IPS?
... View more
05-16-2018
10:02 AM
The scenario for setup of the distributed Splunk install for 2 TE consoles should be included in the 3.0.0 documentation. The only "trick" is to manage the settings off the "first" configuration built.
So in your case you will setup a configuration for the first TE console, duplicate it, and then modify the primary configuration to point to the second TE console while leaving the duplicated configuration for the first TE console.
With regard to you Policy Test Results and full element content, can you specify, is this a matter of wanting information from Detailed Test Results but NOT wanting Detailed Changes? Or another scenario?
... View more
05-14-2018
12:41 PM
What version of the Add-on/App are you using?
What product version?
... View more
10-06-2017
01:14 PM
1 Karma
It appears that if someone goes into the dbconnect app and goes through the process to “Save” the ip360_scan_status input, then the dbconnect adds new parameters to our inputs.conf that creates this problem.
So an example inputs.conf with the "extra" lines from the save would be like this:
[root@localhost apps]# diff splunk_app_db_connect/local/inputs.conf splunk_app_db_connect/local/inputs.conf.bak
83,86d82
< enable_query_wrapping = 1
< tail_rising_column_fullname = (003) nc_audit.end_date.timestamptz
< tail_rising_column_checkpoint_value = 2017-10-06 15:40:46.213108-04
< disabled = 0
To fix the error:
1. Delete the enable_query_wrapping, tail_rising_column_fullname, and tail_rising_column_checkpoint_value lines from the input.conf
2. Disable/re-enable the ip360_scan_status input
3. This should start working again.
WARNING: Make sure you do not go back through the input in the dbconnect app and click Save again! If you do, those parameters are added to the input.conf and the app is broken again.
... View more
10-05-2017
01:39 PM
What version of the add-on are you using?
... View more
10-05-2017
12:59 PM
The Tripwire IP360 Add-On requires either Splunk DB Connect V1 or Splunk DB Connect V2.
v3 is not supported.
... View more
10-05-2017
12:51 PM
The error you’re seeing is because the lookup table asset_info doesn’t exist on the splunk system that you’re using to view your dashboards. This lookup table would appear as te_assets.csv in TA_tripwire_enterprise/lookups.
The TA will automatically retrieve asset data from TE and write te_assets.csv out to disk if you enable the input on that splunk instance. To do that you can enable the “$SPLUNK_HOME/etc/apps/TA_tripwire_enterprise/bin/te_assets.py” Script input from the Settings -> Data Inputs -> Scripts section of the UI.
Alternatively you can add “disabled = 0” to TA_tripwire_enterprise/local/inputs.conf underneath the [script://$SPLUNK_HOME/etc/apps/TA_tripwire_enterprise/bin/te_assets.py] section and restart splunk.
Once TA_tripwire_enterprise/lookups/te_assets.csv exists, the error you’re seeing should go away.
... View more
03-31-2017
11:27 AM
pshew! No problem, and glad you're sorted!
You should now have a tripwire-enterprise-app-for-splunk_200.zip AND A tripwire-enterprise-add-on-for-splunk_200.zip
You have been missing the tripwire-enterprise-add-on-for-splunk_200.zip 🙂
... View more
03-31-2017
11:12 AM
Just to be clear, apps 3058 and 1828 are not the same and the .SPLs are in fact different.
... View more
03-31-2017
11:10 AM
Ah, OK, so you need to install the Add-On. 🙂
Tripwire Enterprise Add-on for Splunk TA_tripwire_enterprise 2.0
Yes
No
App | Permissions Enabled | Disable Set up | Edit properties | View objects | View details on SplunkApps
I did a quick video showing setup, never mind that I forgot my TE user password for the integration... https://www.screencast.com/t/oInPfrGao
... View more
03-29-2017
11:48 AM
You should be able to bring up the settings for the app in Manage Apps.
You put in an IP or FQDN, user, pass, and polling frequency for FIM and SCM.
Takes maybe 5 minutes and you should be good to go.
Are you logged in as admin when you install the app?
... View more
03-29-2017
10:28 AM
And are you getting login events for the Splunk user int he Tripwire logs?
... View more
03-29-2017
09:50 AM
We run TE and Splunk on the same Linux box as part of our standard demo kit for all SEs so there is no need for the heavy forwarder.
Also, the apps are different, so O sent you the add-on in e-mail so you can get it from there.
... View more
03-27-2017
01:15 PM
Happy to see you are using the App for Tripwire Enterprise and it sounds like you have a straigh forward install of the App on the Splunk Search Head. So you point TE log management toward Splunk and are getting logs.
Have you installed the Tripwire Enterprise Add-on for Splunk?
https://splunkbase.splunk.com/app/3058/
The Add-on collects FIM and SCM reports (changes and policy results) via API and formats them with CIM.
Happy Splunking!
... View more
11-09-2016
07:02 AM
The 2.0 version of the app has a separate TA available here: https://splunkbase.splunk.com/app/3058/
Let me know if you have any issue, I'm happy to help improve the app.
... View more
06-08-2016
05:29 PM
Originally the app was intended to be installed on a Search Head with the logs going to the search head.
An alternative is to use a heavy forwarder.
The universal forwarder method described may not work.
... View more
06-08-2016
05:23 PM
What version of the app are you using? The current version is 1.5.4
What you are describing is not typical behavior.
It may be helpful to look at the Tripwire Enterprise logs to see if the app is opening multiple connections.
... View more
11-25-2015
09:11 AM
The app will require the Heavy Forwarder as the tripwire.py is dependent on a python environment that is not included with the universal forwarder.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
