If there are still issues like these on 3.2.4, I suggest to: clear out the TA-dmarc/local/ directory (which resets the config back to default) if that doesn't work: remove the entire add-on from the heavy forwarder and reinstall This seems to solve a number of reports where there were still Python2/3 related issues resulting in TA-dmarc: Introspecting scheme=<something> : script running failed (exited with code 1). I haven't been able to reproduce any of these weird errors. A clean install on any Splunk version Just Works. I also tested some upgrade scenarios but haven't been able to find any issues there either. So I can't offer any direct solution, except for the "delete and reinstall" workaround above.   ... View more

Just a quick note for other who might land here via Google: this issue was fixed in 3.2.3. From the changelog (nov. 26, 2020): Added support for Splunk 8.1. (Thanks to Aaron Myers for reporting the issue) Fixed exception when using add-on together with listenOnIPv6=yes (Thanks to gryphius for reporting this issue) Fixed Gmail POP3 issue ... View more

Ok thanks, I haven't tested it on Splunk 8.1, and given the other commenters experience I excpect you to experience the same issue, probably in splunkd.log instead of the TA logging because it doesn't even get that far. If you provide me privately with a client id and client secret to test with I can look into it, but don't expect a quick turnaround as I have other stuff to do as well.  ... View more

This seems like a separate issue. I haven't tested it on Splunk 8.1. Given the fact that it defaults to python.version=3, and the fact that some of the libraries in the addon are py2 only, I doubt it will work without additional development work. Given that this is an easily reproducible issue I'm willing to make it work on for Splunk 8.1 installs, but only if you can provide me privately with a client id and client secret so I can test. ... View more

I haven't seen this behaviour before. But I must admit that I cancelled the expensive Windows E5 subscription I used for developing. At least 6 months ago I can say "it worked for me". Can you share some more details about your setup? Splunk version? Any clue-giving errors in var/log/splunk/ta_defender...log? ... View more

Depending on the most recent DMARC report in the mailbox, you may need to adjust the search window to something like year-to-date. ... View more

Try to expand the timerange. The eventdate will be the date of the xml report. Depending on the report volume you may have to look back days, weeks or months. ... View more

You could try to clean the checkpointing data in kvstore with this snippet below, so the addon will process the missing emails again. Other than that I dont see anything weird in the logs, in fact these look just like regular logs from a working TA-dmarc deployment. |inputlookup ta_dmarc_checkpointer_lookup |search state!="*input=dmarc_imap, server=*" |outputlookup ta_dmarc_checkpointer_lookup ... View more

If you want to pull security alerts from all things ATP and have them mapped to CIM look no furher than “Microsoft Graph Security API Add-On for Splunk”. Maintained by MS! My TA allows you to schedule KQL queries for more subtle endpoint telemetry stuff like “this and this file appeared in this directory”. For example macro files in office startup dirs. Oh and I don’t map to CIM because the telemetry data is way too varied. ... View more

Yes I’ve created an issue on Github to remind me. I will probably start looking into it in july summertime as I have some more time then. Pull requests welcome btw. ... View more

TLSv1.0 is not supported out-of-the box. To support older exchange boxes like yours, change line 55 of imap2dir.py : https://github.com/jorritfolmer/TA-dmarc/blob/master/bin/dmarc/imap2dir.py#L55 ... View more

Ah yes thanks! 7.3 is supported. I'm running it myself on 7.3.1. I've updated the compatible version list. It shows up now through the applet. ... View more

Ok I fixed the root-cause of this error (on Github for now). It has to do with the way I set the proxy configuration. The way I implemented it would also cause Splunk internal calls to go through the proxy which is obviously wrong. So I re-implemented proxy support. I've tested it with a Squid proxy in my testlab, and it works properly now. ... View more

Can you try if version 1.3.0 (on Github only) fixes this for you? If so, I'll publish it on Splunkbase ... View more

Implemented proxy support. The configure screen now has an extra tab for proxy stuff. Only on Github for now. I'll release it on Splunkbase after positive feedback ... View more

Did you get it working eventually? Not sure what to make of it. It works for me, even tried on a fresh splunk instance with fresh install from splunkbase. ... View more

Succesfull connections to my gmail dmarc mailbox look like this. In DEBUG so sorry for the screenspam. 2019-02-17 19:35:05,971 INFO pid=5027 tid=MainThread file=base_modinput.py:log_info:293 | Start processing imap server imap.gmail.com with use_ssl True 2019-02-17 19:35:06,060 DEBUG pid=5027 tid=MainThread file=base_modinput.py:log_debug:286 | get_dmarc_messages: successfully connected to imap.gmail.com 2019-02-17 19:35:08,047 INFO pid=5027 tid=MainThread file=base_modinput.py:log_info:293 | get_dmarc_messages: 343 messages in folder INBOX 2019-02-17 19:35:08,764 INFO pid=5027 tid=MainThread file=base_modinput.py:log_info:293 | get_dmarc_messages: 334 messages in folder INBOX match subject "Report domain:" then look for filter_seen_messages: 19-02-17 19:35:09,403 DEBUG pid=5027 tid=MainThread file=base_modinput.py:log_debug:286 | filter_seen_messages: uids on imap set([5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16, 1 7, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 44, 45, 46, 47, 48, 49, 50, 51, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 87, 88, 89, 90, 91, 92, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108 , 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144 , 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179 , 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 208, 209, 210, 211, 212, 213, 214, 215 , 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252 , 253, 254, 255, 256, 257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287 , 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 331, 332, 333, 334, 335, 336, 337, 338, 339, 340, 341, 342, 343, 344, 345, 346, 347, 348, 349]) and finally processing of actual dmarc report mails: 2019-02-17 19:35:09,403 INFO pid=5027 tid=MainThread file=base_modinput.py:log_info:293 | Start processing 221 new messages of 334 on imap.gmail.com 2019-02-17 19:35:09,403 INFO pid=5027 tid=MainThread file=base_modinput.py:log_info:293 | get_dmarc_message_bodies: getting messages 0 to 100 2019-02-17 19:35:22,082 INFO pid=5027 tid=MainThread file=base_modinput.py:log_info:293 | get_dmarc_message_bodies: getting messages 100 to 200 2019-02-17 19:35:32,529 INFO pid=5027 tid=MainThread file=base_modinput.py:log_info:293 | get_dmarc_message_bodies: getting messages 200 to 221 2019-02-17 19:35:38,666 DEBUG pid=5027 tid=MainThread file=base_modinput.py:log_debug:286 | save_reports_from_message_bodies: start non-multipart processing of msg uid 126 2019-02-17 19:35:38,666 DEBUG pid=5027 tid=MainThread file=base_modinput.py:log_debug:286 | check_eligible_mimtype: checking content-type application/zip of msg uid 126 2019-02-17 19:35:38,670 DEBUG pid=5027 tid=MainThread file=base_modinput.py:log_debug:286 | write_part_to_file: saved file /tmp/tmpwta3FW/google.com!nanowolk.nl!1526860800!1526947199.zip from uid 126 ... View more

Thanks for the report, I'll look into it when I have time somewhere next week. Can you create an issue in the Github tracker? ... View more

Ah Splunk on Linux has no concept of UNC paths or Windows domains so this will never work. Best alternative is to mount the Windows share under /mnt/something. You should probably investigate mount -t cifs. ... View more

Which of these assumptions is correct? - you're running Splunk on Windows - you're running Splunk as LOCAL\SYSTEM - \fileshare\path1\path2\ is on a Windows server in the same domain as the Splunk server On Windows, UNC paths are supported on the condition that you run Splunk under a service account that can access domain resources like the share you're accessing. If however you run Splunk as LOCAL\SYSTEM on Windows, the best I've been able to come up with is using "psexec -s -i cmd.exe" and then "net use y: //fileshare/path/path /user:domain\someuser". Domain resources aren't available to LOCAL\SYSTEM so this as an ugly workaround to make them available as Y: drive while using some non-privileged domain user. ... View more

Perhaps it has something to do with other (hidden) files that are also present in the directory you monitor? When I look at my own installations there are various Bro related files like .state, .status .rotated. etc that may get scanned for lines starting with "#fields", so INDEXED_EXTRACTIONS = TSV returns proper header names. You may try to change the monitor stanza to something like [monitor:///syslog_hot/splunk/bro/*.log], or also blacklist any files in that directory that don't start with "#fields" ... View more

I set it to some dummy value, as far as I know there is no such URL for ADFS. You don't really need one if you set additional claim rules filling the "role" field. This is enough for Splunk to put users into the admin/power/user groups. ... View more

I've played with it last weekend and got it working. Since version 6.3 Splunk support native SAML authentication. However there are a number of caveats, one of which is to disable signing of AuthnRequest that Splunk sends to ADFS, and the other that logout doesn't seem to be working due to an "invalid SAML request". The docs mention to only provide support for PingIdentity as SAML provider for now, so your miles may vary. See Example #5 on my Github (https://github.com/jorritfolmer/puppet-splunk) for some screenshot on how to setup the ADFS side to get SAML authentication working. ... View more