It appears that in the "TA-microsoft-windefender"-addon something is missing that causes warnings in the search-log but more important, it does not do what it is supposed to do. The problem is contained in ".../default/props.conf" In line 25 is stated: EVAL-Feature_Name = case(Feature_Name="%%802", Which is obviously an incomplete eval-expression. Does anyone have sorted out how this full line should look like? Thanks! ... View more

Apparently the Qualys Technology Add-on (TA) for Splunk stops fetching data after 503-errors. First it will try 3 times and after the third 503 (Service Unavailable) it starts redirecting and to unclear where. The redirected requests are tried for an infinite number of times. The only way out is to kill the python-script. At the next fetch-interval it will start automatically and continues collecting data without problems. This happens for all three input-types (host_detection, was_findings, policy_posture). Any idea how to solve this? Thanks! Here is the logging for host_detection only: TA-QualysCloudPlatform: 2018-08-23 22:00:14 PID=16129 [MainThread] INFO: TA-QualysCloudPlatform [host_detection] - Making request: https://qualysapi.qualys.eu/msp/about.php with params={} TA-QualysCloudPlatform: 2018-08-23 22:00:15 PID=16129 [MainThread] ERROR: TA-QualysCloudPlatform [host_detection] - Unsuccessful while calling API [503 : Service Unavailable]. Retrying: https://qualysapi.qualys.eu/msp/about.php with params={}. Retry count: 1 Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/lib/api/Client.py", line 253, in get request = urllib2.urlopen(req, timeout=timeout) # timeout set to bail in case of timeouts File "/opt/splunk/lib/python2.7/urllib2.py", line 154, in urlopen response = meth(req, response) File "/opt/splunk/lib/python2.7/urllib2.py", line 437, in open response = meth(req, response) File "/opt/splunk/lib/python2.7/urllib2.py", line 550, in http_response 'http', request, response, code, msg, hdrs) File "/opt/splunk/lib/python2.7/urllib2.py", line 475, in error return self._call_chain(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 409, in _call_chain result = func(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 558, in http_error_default raise HTTPError(req.get_full_url(), code, msg, hdrs, fp) HTTPError: HTTP Error 503: Service Unavailable TA-QualysCloudPlatform: 2018-08-23 22:05:15 PID=16129 [MainThread] ERROR: TA-QualysCloudPlatform [host_detection] - Unsuccessful while calling API [503 : Service Unavailable]. Retrying: https://qualysapi.qualys.eu/msp/about.php with params={}. Retry count: 2 Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/lib/api/Client.py", line 253, in get request = urllib2.urlopen(req, timeout=timeout) # timeout set to bail in case of timeouts File "/opt/splunk/lib/python2.7/urllib2.py", line 154, in urlopen return opener.open(url, data, timeout) File "/opt/splunk/lib/python2.7/urllib2.py", line 437, in open response = meth(req, response) File "/opt/splunk/lib/python2.7/urllib2.py", line 550, in http_response 'http', request, response, code, msg, hdrs) File "/opt/splunk/lib/python2.7/urllib2.py", line 475, in error return self._call_chain(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 409, in _call_chain result = func(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 558, in http_error_default raise HTTPError(req.get_full_url(), code, msg, hdrs, fp) HTTPError: HTTP Error 503: Service Unavailable TA-QualysCloudPlatform: 2018-08-23 22:10:15 PID=16129 [MainThread] ERROR: TA-QualysCloudPlatform [host_detection] - Unsuccessful while calling API [307 : Temporary Redirect]. Retrying: https://qualysapi.qualys.eu/msp/about.php with params={}. Retry count: 3 Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/lib/api/Client.py", line 253, in get request = urllib2.urlopen(req, timeout=timeout) # timeout set to bail in case of timeouts File "/opt/splunk/lib/python2.7/urllib2.py", line 154, in urlopen return opener.open(url, data, timeout) File "/opt/splunk/lib/python2.7/urllib2.py", line 437, in open response = meth(req, response) File "/opt/splunk/lib/python2.7/urllib2.py", line 550, in http_response 'http', request, response, code, msg, hdrs) File "/opt/splunk/lib/python2.7/urllib2.py", line 469, in error result = self._call_chain(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 409, in _call_chain result = func(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 635, in http_error_302 new = self.redirect_request(req, fp, code, msg, headers, newurl) File "/opt/splunk/lib/python2.7/urllib2.py", line 596, in redirect_request raise HTTPError(req.get_full_url(), code, msg, headers, fp) HTTPError: HTTP Error 307: Temporary Redirect TA-QualysCloudPlatform: 2018-08-23 22:15:15 PID=16129 [MainThread] ERROR: TA-QualysCloudPlatform [host_detection] - Unsuccessful while calling API [307 : Temporary Redirect]. Retrying: https://qualysapi.qualys.eu/msp/about.php with params={}. Retry count: 4 Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/lib/api/Client.py", line 253, in get request = urllib2.urlopen(req, timeout=timeout) # timeout set to bail in case of timeouts File "/opt/splunk/lib/python2.7/urllib2.py", line 154, in urlopen return opener.open(url, data, timeout) File "/opt/splunk/lib/python2.7/urllib2.py", line 437, in open response = meth(req, response) File "/opt/splunk/lib/python2.7/urllib2.py", line 550, in http_response 'http', request, response, code, msg, hdrs) File "/opt/splunk/lib/python2.7/urllib2.py", line 469, in error result = self._call_chain(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 409, in _call_chain result = func(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 635, in http_error_302 new = self.redirect_request(req, fp, code, msg, headers, newurl) File "/opt/splunk/lib/python2.7/urllib2.py", line 596, in redirect_request raise HTTPError(req.get_full_url(), code, msg, headers, fp) HTTPError: HTTP Error 307: Temporary Redirect TA-QualysCloudPlatform: 2018-08-27 13:58:33 PID=16129 [MainThread] ERROR: TA-QualysCloudPlatform [host_detection] - Unsuccessful while calling API [307 : Temporary Redirect]. Retrying: https://qualysapi.qualys.eu/msp/about.php with params={}. Retry count: 1056 Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/lib/api/Client.py", line 253, in get request = urllib2.urlopen(req, timeout=timeout) # timeout set to bail in case of timeouts File "/opt/splunk/lib/python2.7/urllib2.py", line 154, in urlopen return opener.open(url, data, timeout) File "/opt/splunk/lib/python2.7/urllib2.py", line 437, in open response = meth(req, response) File "/opt/splunk/lib/python2.7/urllib2.py", line 550, in http_response 'http', request, response, code, msg, hdrs) File "/opt/splunk/lib/python2.7/urllib2.py", line 469, in error result = self._call_chain(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 409, in _call_chain result = func(*args) File "/opt/splunk/lib/python2.7/urllib2.py", line 635, in http_error_302 new = self.redirect_request(req, fp, code, msg, headers, newurl) File "/opt/splunk/lib/python2.7/urllib2.py", line 596, in redirect_request raise HTTPError(req.get_full_url(), code, msg, headers, fp) HTTPError: HTTP Error 307: Temporary Redirect ... View more

Hello, If I add a new role with an inheritence of for instance "User" the addition of capabilities won't have any effect. For instance if I want to provide a user with the right to manage other users I won't get this option in Manager. I tested this with 4.3. Not sure if earlier version had the same behavior. Thanks! ... View more

I'm running the following search: index="_internal" source="*license_usage.log" The problem is that all hosts report received bytes, eventhough there are no events received. The lowest number I have seen is 134 bytes (b=134). Does anyone know why I see these and how I can report on the real number of indexed bytes? Thanks! ... View more

What is best practice to get VMware security logs into Splunk. They will not be send with Syslog but are only accessable from the console. ... View more