How can we resolve some errors when restarting splunkd on our Splunk ES search-head?: Invalid key in stanza [sendtoplaybook] in /opt/splunk/etc/apps/TA-threatconnect/default/alert_actions.conf, line 6: param.playbook_endpoint (value: ). Invalid key in stanza [sendtoplaybook] in /opt/splunk/etc/apps/TA-threatconnect/default/alert_actions.conf, line 7: param.fields (value: ). Value in stanza [sourcetype=sendtoplaybook:results] in /opt/splunk/etc/apps/TA-threatconnect/default/tags.conf, line 1 not URL encoded: sourcetype = sendtoplaybook:results TA-threatconnect/default/alert_actions.conf is causing the Adaptive Response Actions menu to malfunction on our Splunk ES search-head. To recreate: Open Enterprise Security -> Configure -> Content Management -> Select a Correlation Search to Edit -> Scroll to bottom of page. Issues: Under "Adaptive Response Actions", selections " Risk Analysis" and "Notable" are missing. Selecting "+ Add New Response Action" opens an empty selection menu. Removing TA-threatconnect/default/alert_actions.conf mitigates the splunk startup errors and the Adaptive Response Actions menu malfunction. Any suggestions and/or fixes are welcome. ... View more

Looking for insights as to what's the source of some errors we're seeing with DUO Splunk Connector. We installed the app on a heavy-forwarder and it's generally working. However, we're seeing several of these errors in splunkd.log: ERROR JsonLineBreaker - JSON StreamId:11840170364389813249 had parsing error:Unexpected character while looking for value: '<' - data_source="duo", data_host="duo_api", data_sourcetype="json" Any suggestions? ... View more

How might one obtain a list of all the Windows domain members a specific user is currently logged in to? Our domain controllers have Splunk UF with Splunk_TA_windows and Splunk_TA_microsoft_ad add-ons, and we're running both Splunk Enterprise as well as Splunk Enterprise Security. Thanks for any suggestions. ... View more

Hi, we've been successfully running this add-on on a heavy-forwarder (HF) for a while. The add-on connects to tap-api-v2.proofpoint.com every 10 minutes. Starting yesterday (Sunday), ProofPooint_TAP_SIEM logs stopped getting indexed. splunkd.log on our HF running this add-on reports an error. We went from this: 12-02-2018 10:31:05.412 -0500 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/proofpoint_tap_siem.py" proofpoint_tap_siem://Proofpoint: query_and_save/Successful query from 2018-12-02T15:21:05Z to 2018-12-02T15:31:04Z to this: 12-02-2018 10:41:04.836 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/proofpoint_tap_siem.py" proofpoint_tap_siem://Proofpoint: stream_events/[Errno 111] Connection refused The firewall logs indicate that this HF is no longer connecting to the API server at this point. And this appears to be confirmed by running tcpdump on the HF, where we see no connection attempts to dst 148.163.148.173 or dst 148.163.152.173. How can we enable debugging to troubleshoot this issue? Thanks. ... View more

I'm trying to use the "Add-On for MAC Lookup " and it errors with 'command="maclookup", : failed to use the netaddr module!' For example, my Splunk search produces a table with 1 entry: dest_hostname dest_nt_host dest_ip dest_mac dest_subnet_name android-1fe665ec066a8cdd android-1fe665ec066a8cdd.home 10.1.1.99 dc:44:b6:99:f9:a5 Guest-Wifi whereupon I invoke maclookup: ... | table dest_hostname, dest_nt_host, dest_ip, dest_mac, dest_subnet_name | maclookup field=dest_mac ... resulting in: command="maclookup", : failed to use the netaddr module! No results found. Enabling debug, I see the following in maclookup.log: 2018-11-26 15:39:55,142 INFO maclookup:139 - using mac to lookup : dc:44:b6:99:f9:a5 2018-11-26 15:39:55,142 INFO maclookup:141 - netaddr lookup: DC-44-B6-99-F9-A5 ... 2018-11-26 15:39:55,224 ERROR maclookup:154 - failed to use the netaddr module! I've restarted splunkd on this system (RHEL 7.5) a few times, and even rebooted the server, but that hasn't made a difference. It seems that this error is the result of an OEM vendor not being found in the netaddr lookup. When I manually paste the MAC addr dc:44:b6:99:f9:a5 into https://www.macvendorlookup.com/ , the site returns: Company: No Vendor Exists When the table includes a different MAC addr, netaddr may give no error. For example, if the table includes: dest_hostname dest_nt_host dest_ip dest_mac dest_subnet_name ETs-Phone ETs-Phone.home 10.1.1.50 00:56:cd:95:16:62 Guest-Wifi ... maclookup gives no error. When I manually paste the MAC addr 00:56:cd:95:16:62 into https://www.macvendorlookup.com/ , the site returns: Company: Apple, Inc. This leads me to the question of whether we can get this add-on to use a different site, such as https://www.wireshark.org/tools/oui-lookup.html Thanks. ... View more