About bwgates

bwgates · ‎05-11-2021

I know this is an old post, but I had to submit a reply based off something I found to be my issue with this particular subject. I recently modified the search peers via the deployer for my SHC and later come to realize the search peer configuration didn't take on all the members of the SHC. I'm currently running three members and each of them had a different list of search peers, but a combination of what the actual list of search peers were. I just had to do a rolling restart on the SHC and everything went back to normal and search peer distribution was corrected. I'm not sure if it was an issue with the deployer not restarting Splunk on all the members or what, but that resolved my issue. You can look at the DMC view Search > Search Head Clustering > Search Head Clustering: Status and Configuration to verify.

bwgates · ‎06-14-2019

I wasn't able to create a data input using the Tenable Add-on for Splunk version 2.0.1 and was getting the below error. The proxy option wasn't selected in the account configuration by both GUI and .conf and I couldn't even add our proxy or it will error as well. I'm sure this a configuration issue on my end with it being blocked in some fashion at the proxy. However, to the point, I did have a proxy configured in my "/etc/environment" (echo $http_proxy). I am able to successfully create a data input after removing that from my environment variables and having no proxy configured in the add-on itself. Just wanted to share this with anyone else that may be having this same issue. HTTPSConnectionPool(host='XXXXXXXXXX', port=443): Max retries exceeded with url: /rest/system (Caused by ProxyError('Cannot connect to proxy.', error('Tunnel connection failed: 403 Forbidden',)))

bwgates · ‎04-04-2019

The indexes required by this app are using over 200GB of our Splunk license a day. I don't believe this to be normal behavior. This was from a fresh install and I verified the checkpoints from the online doc are valid (below). The only difference from the online doc and what I see in my configs from a fresh install is my app is missing "[isight_indicators]" and has "[isight_vulnerability]" - Page 15-16 Anyone else run into this issue before as well? Referenced online doc: link text [isight_iocs] history_exec = 1544400000 last_exec = 1554375748 [isight_vulnerability] history_exec = 1544400000 last_exec = 1554407948

bwgates · ‎01-10-2019

@nkeuning Thanks for the information. I'll keep an eye out for the new app and see what else we can do until then.

bwgates · ‎01-09-2019

@nkeuning Thanks for the quick response. Do you have a timeline on when this is supposed to be accomplished and released? If I'm understanding correctly, this seems like a good metric for an individual host, but when scans per host start at a different time and possibly day, the actual date of the initiation of the scan will be hard to determine. Especially when using Nessus agents as all hosts will scan at a different time and possibly a different day due to the type of the device, if the device was on the network when the scan was scheduled, etc. Basically, I'm trying to isolate a single scan date, per scan ID, and report based on those metrics. It might be worth while to isolate the "Scan Start Date" in plugin ID 19506 as it's own JSON field so it's easier to search.

bwgates · ‎01-09-2019

We previously had a dashboard to compare vulnerability results to compliance results and were able to define a date the scan happened to verify patching levels. Were not able to do this with the new add-on. We did create a search time extraction based on a Tenable plugin that has the scan date in it, but the search will only show events for that plugin and not all plugins for the selected scan. Anyone run into this issue or can provide some pointers to get a scan date and show all results? Thanks much! sourcetype=tenable:sc:vuln plugin_id=19506 | rex field=plugin_id "(?)\d{4}\d{1,2}\d{1,2}"

bwgates · ‎03-27-2018

I've been able to configure SSO for CAC via Apache proxy and everything works fine. I'm trying to figure out how to display a login banner like if you were to use username and password on the default Splunk login page where the user has to "accept" or at least be prompted fr some tpe of input before the user is allowed into Splunk. Has anyone been able to get this configured or point me in the right direction? Google searches didn't really help a lot. Thanks in advance.

Posts	7
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎03-27-2018

Online Status	Offline
Date Last Visited	‎04-05-2022 08:00 AM

Tenable Proxy Configuration

App License Usage

How do you get the scan date from scans as a searc...

SSO login banner when using a CAC

Re: Skipped Searches on SHC

Tenable Proxy Configuration

App License Usage

Re: How do you get the scan date from scans as a s...

Re: How do you get the scan date from scans as a s...

How do you get the scan date from scans as a searc...

SSO login banner when using a CAC