About atellez_splunk

atellez_splunk · ‎02-01-2018

The props do not support syslog extraction, they are designed to read directly from /var/log/suricata/eve.json For syslog you would need to re-write the props to extract each field.

atellez_splunk · ‎05-03-2017

I tested hex values shortly after posting this, using hex values solves the problem.

atellez_splunk · ‎05-03-2017

Specifying color or multiple colors as an eval argument creates black outlines on the lines. | eval color = case ( match(app, "dns"), "green", match(app, "tls"), "yellow", 1==1, "red")

atellez_splunk · ‎03-08-2017

Most of my traffic originates out of NYC, using iplocation the lat and lons appeared to be flipped. The following search fixed the issue: | iplocation src_ip prefix=start_ | rename start_lat AS start_lonx, start_lon AS start_latx | rename start_latx AS start_lat, start_lonx AS start_lon | iplocation dest_ip prefix=end_ | rename end_lat AS end_lonx, end_lon AS end_latx | rename end_latx AS end_lat, end_lonx AS end_lon | head 100 | table start_lat start_lon end_lat end_lon | eval animate="yes", pulse_at_start="yes" I am going to guess that somehow the visualization is interpreting these opposite of how you intended them to appear on the map.

atellez_splunk · ‎02-15-2017

I just saw this question, it needs to be deployed to the indexers and search heads. Indexers for the linebreaker, search head for the searchtime props.conf, tags.conf.

atellez_splunk · ‎02-15-2017

The Suricata TA currently supports CIM mappings for the eve.json output only. Fast.log does not have nearly all of the key value information needed for Enterprise Security - from what I can recall. The json option is also natively recognized by Splunk, so in the event you need to search against the raw data it will have syntax highlighting.

atellez_splunk · ‎01-12-2017

Thanks, I'll make a correction, it should be set to answer only, will adjust in the next version.

atellez_splunk · ‎06-06-2016

The TA uses sourcetype pipelines in order to "match" the event to three different types of logs: pmp_resource, pmp_login, pmp_notification. If the fields are failing to extract the syslog output from your appliance might not match the regular expressions found in the TA. An easy way to test this is to copy some logs into a regex editor (regex101.com) and use the EXTRACT regexes to test that the regexes are valid against your logs. Example for pmp_resource logs: EXTRACT-passman=(?P<date>\d+\-\d+\-\d+\s\d+\:\d+\:\d+)\s(?P<facility>\w+\.\w+)\s(?P<program>\w+)\s(?P<otherdate>\w+\s\d+\s\d+\:\d+\:\d+)\s(?P<host>\w+)\s(?P<logged_in_username>\S+)\:(?P<src>\S+)\s(?P<operation_type>\S+)\s(?P<operated_time>\d+\/\d+\/\d+\s\d+\:\d+\:\d+)\s(?P<status_of_operation>\w+)\s(?P<pmp_server_name>\S+)\s(?P<dest>\S+)\:(?P<user>\S+)\:(?P<reason>\S+)

atellez_splunk · ‎03-17-2016

The TA does not monitor the log path or source of where the data is coming from. It only normalizes the data when you set the sourcetype to ruckus:log to those other sourcetypes specified in props.conf based on regex matches. If you use a custom port for syslog, you would not need to create 13 stanzas. You could do something like this in the Ruckus TA's local/ directory: inputs.conf [udp://516] index = network (or whatever index you wish to use) sourcetype = ruckus:log connection_host = ip It is actually better, to set up a syslog server and read the log files from disk using the universal forwarder, this way you don't lose any UDP data during a splunkd restart.

atellez_splunk · ‎03-17-2016

It is easier to set the sourcetype to ruckus:log during the inputs.conf phase, due to how the sourcetype pipelines work in the TA. I would first try this approach to validate the logs are being transformed into the different sourcetypes that ship with the TA: -ruckus:core:reconnect, ruckus:core:disconnect, etc. [monitor:///var/log/syslog-ng/ruckus_log/127.0.0.1/2016-03-16/messages.log] index = network sourcetype = ruckus:log host_segment = 5 alternatively: [udp://xxx.xxx.xxx.xxx:514] index = network sourcetype = ruckus:log connection_host = ip

atellez_splunk · ‎09-09-2015

Hi Mikael, Thanks for this information, I must have missed it. I only recently added network flows to the Suricata TA in version 2. I will make corrections and add these tags to the TA. You can view Suricata data on the following dashboards in Enterprise Security: Security Domains > Network > Intrusion Center Security Domains > Network > Web Center Advanced Threat > Protocol Intelligence > DNS Activity Advanced Threat > Protocol Intelligence > SSL Activity

atellez_splunk · ‎06-11-2015

Whoops! 🙂 Thanks for that. I must have grabbed the wrong file when I merged to github. I'll update right away!

Posts	12
Solutions	2
Karma Given	10
Karma Received	6
Member Since	‎11-20-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Mulit-Color eval, causes black outline

Lat/Lon are flipped.

Re: json field extraction not working

Re: Mulit-Color eval, causes black outline

Mulit-Color eval, causes black outline

Lat/Lon are flipped.

Re: Splunk TA for Suricata: Where to install and d...

Re: What are the best practices for implementing S...

Re: Splunk TA for Suricata: Error in props.conf ?

Re: Splunk TA for Password Manager Pro: I've set t...

Re: Splunk Add-on for Ruckus Wireless - Fields not...

Re: Splunk Add-on for Ruckus Wireless - Fields not...

Re: Splunk TA for Suricata and Enterprise Security...

Re: Wrong props/transforms in this one. easy to f...