Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mbrownec
mbrownec
Explorer
Member since:
03-11-2016
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 1 |
| Karma Given | 8 |
| Karma Received | 2 |
| Member Since | 03-11-2016 |
Activity Feed
- Karma Re: How to write a search to alert on anomalous network traffic? for tjr1775. 06-05-2020 12:48 AM
- Karma Re: Listing hosts that haven't been locked for 24 hours for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Listing hosts that haven't been locked for 24 hours for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: How to capture URL information for btorresgil. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I unable to execute Powershell or batch alert scripts in Windows?. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I unable to execute Powershell or batch alert scripts in Windows?. 06-05-2020 12:48 AM
- Karma Powershell script triggered from alert is not executing but I can see it triggered in python.log for neiljpeterson. 06-05-2020 12:47 AM
- Karma Re: Why are my alerts not being triggered? for ben363. 06-05-2020 12:47 AM
- Karma Re: How can I send data from another machine to the machine running splunk Universal forwarder and then have the forwarder send it to the machine running the receiver? for rsennett_splunk. 06-05-2020 12:46 AM
- Karma Re: splunk result has fields unwanted for steveyz. 06-05-2020 12:45 AM
- Posted Re: How to use encrypted passwords in IMAP mailbox APP on All Apps and Add-ons. 08-02-2017 12:12 PM
- Posted Re: Why am I unable to execute Powershell or batch alert scripts in Windows? on Alerting. 12-14-2016 12:45 PM
- Posted Why am I unable to execute Powershell or batch alert scripts in Windows? on Alerting. 11-28-2016 02:50 PM
- Tagged Why am I unable to execute Powershell or batch alert scripts in Windows? on Alerting. 11-28-2016 02:50 PM
- Tagged Why am I unable to execute Powershell or batch alert scripts in Windows? on Alerting. 11-28-2016 02:50 PM
- Tagged Why am I unable to execute Powershell or batch alert scripts in Windows? on Alerting. 11-28-2016 02:50 PM
- Tagged Why am I unable to execute Powershell or batch alert scripts in Windows? on Alerting. 11-28-2016 02:50 PM
- Tagged Why am I unable to execute Powershell or batch alert scripts in Windows? on Alerting. 11-28-2016 02:50 PM
- Posted Re: Why are my alerts not being triggered? on Alerting. 11-23-2016 09:22 AM
- Posted How to track Hash changes of files with sysmon input (tracking change in results with daily reports)? on All Apps and Add-ons. 04-27-2016 06:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
08-02-2017
12:12 PM
https://github.com/IMAPMailbox/IMAPmailbox/issues/8
run the following: echo|set /p="password_no_new_line_char" | "C:\Program Files\Splunk\bin\splunk.exe" cmd openssl bf -e -a -pass file:"C:\Program Files\Splunk\etc\auth\splunk.secret"
(replace password_no_new_line_char with the password for the mailbox you will be polling)
Set the output of the previous command as the xpassword value in C:\Program Files\Splunk\etc\apps\IMAPmailbox\local\imap.conf as per the readme ( C:\Program Files\Splunk\etc\apps\IMAPmailbox\README.tx t ),
run the following: echo|set /p="password_no_new_line_char" | "C:\Program Files\Splunk\bin\splunk.exe" cmd openssl bf -e -a -pass file:"C:\Program Files\Splunk\etc\auth\splunk.secret"
(replace password_no_new_line_char with the password for the splunk user who has access to the web UI and REST API)
Set the output of the previous command as the splunkxpassword value in C:\Program Files\Splunk\etc\apps\IMAPmailbox\local\imap.conf as per the readme ( C:\Program Files\Splunk\etc\apps\IMAPmailbox\README.txt ),
Set the mimeTypes value in in C:\Program Files\Splunk\etc\apps\IMAPmailbox\local\imap.conf to any mime type you want to process, such as text/html,text/richtext,text/plain (this should be a comma separated list)
Set the folders value to INBOX or any other IMAP folder in in C:\Program Files\Splunk\etc\apps\IMAPmailbox\local\imap.conf
Create a C:\Program Files\Splunk\etc\apps\IMAPmailbox\local\inputs.conf and input the following:
#disable *nix
[script://./bin/get_imap_email.py]
disabled = true
#enable windows
[script://.\bin\get_imap_email.py]
interval = 300
disabled = false
For IMAPmailbox, you must modify "C:\Program Files\Splunk\etc\apps\IMAPmailbox\bin\get_imap_email.py" in the following way:
modify each call to subprocess.Popen('openssl line with p = subprocess.Popen('openssl bf -d -a -pass file:\"%s\"' % (os.path.join(os.environ['SPLUNK_HOME'],'etc','auth', 'splunk.secret')), shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE) This nests the path to the secret file in double-quotes.
restart splunkd
debug the splunk app:
verify settings that are being used:
"C:\Program Files\Splunk\bin\splunk.exe" cmd btool --app=IMAPmailbox imap list --debug
"C:\Program Files\Splunk\bin\splunk.exe" cmd btool --app=IMAPmailbox inputs list --debug
run a test to verify IMAP connectivity, etc:
cd "C:\Program Files\Splunk\etc\apps\IMAPmailbox"
"C:\Program Files\Splunk\bin\splunk.exe" cmd python bin/get_imap_email.py --debug
... View more
Here's the deal. Splunk support has confirmed that direct execution of powershell scripts is not supported by runshellscript.py.
The "workaround" (not really a workaround as you'll see in a second) is to use a BATch script wrapper.
Also, do not use positional arguments with BATch scripts, as there are escaping problems, use the set environmental variables. Also, you must nest in double-quotes if you use a | character in your search.
Here is a test bat script that produces some verbose output for review:
echo "%SPLUNK_ARG_0%" > "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo "%SPLUNK_ARG_1%" >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo "%SPLUNK_ARG_2%" >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo "%SPLUNK_ARG_3%" >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo "%SPLUNK_ARG_4%" >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo "%SPLUNK_ARG_5%" >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo "%SPLUNK_ARG_6%" >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo "%SPLUNK_ARG_8%" >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo ---we are testing with two percent variables-- >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo %%1 >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo ---we are testing with one percent variables-- >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo %1 >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo %2 >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo %3 >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo %4 >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo %5 >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo %6 >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo %7 >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo %8 >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo ---we are testing with one percent variables embedded in single-quotes embedded in double quotes, semi-color separated-- >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo "'%0';'%1';'%2';'%3';'%4';'%5';'%6';'%7';'%8'">> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo ---we are testing with asterisk-- >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo %* >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
echo ---execute powershell-- >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
powershell.exe -file "C:\Program Files\Splunk\bin\scripts\tester.ps1" "%SPLUNK_ARG_0%";"%SPLUNK_ARG_1%";"%SPLUNK_ARG_2%";"%SPLUNK_ARG_3%";"%SPLUNK_ARG_4%";"%SPLUNK_ARG_5%";"%SPLUNK_ARG_6%";"%SPLUNK_ARG_8%" >> "C:\Program Files\Splunk\bin\scripts\testbat.txt" 2>&1
echo Errorlevel = %errorlevel% >> "C:\Program Files\Splunk\bin\scripts\testbat.txt"
Here is the powershell script that's called within the above batch
$args > "C:\Program Files\Splunk\bin\scripts\test.csv"
"--args[0]---------------" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
$args[0] >> "C:\Program Files\Splunk\bin\scripts\test.csv"
"--args[1]---------------" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
$args[1] >> "C:\Program Files\Splunk\bin\scripts\test.csv"
"--args[2]---------------" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
$args[2] >> "C:\Program Files\Splunk\bin\scripts\test.csv"
"--args[3]---------------" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
$args[3] >> "C:\Program Files\Splunk\bin\scripts\test.csv"
"--args[4]---------------" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
$args[4] >> "C:\Program Files\Splunk\bin\scripts\test.csv"
"--args[5]---------------" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
$args[5] >> "C:\Program Files\Splunk\bin\scripts\test.csv"
"--args[6]---------------" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
$args[6] >> "C:\Program Files\Splunk\bin\scripts\test.csv"
"--args[7]---------------" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
$args[7] >> "C:\Program Files\Splunk\bin\scripts\test.csv"
"--args[8]---------------" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
$args[8] >> "C:\Program Files\Splunk\bin\scripts\test.csv"
"--args[9]---------------" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
$args[9] >> "C:\Program Files\Splunk\bin\scripts\test.csv"
"--args[10]---------------" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
$args[10] >> "C:\Program Files\Splunk\bin\scripts\test.csv"
"--args[11]---------------" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
$args[11] >> "C:\Program Files\Splunk\bin\scripts\test.csv"
Given the various issues I faced while passing the variables to the powershell script (escaping, etc), I found it best to rely on the powershell script to simply parse out a single argument... as is passed to the powershell script via the batch script call to powershell.exe.
Here is the contents of the text file generated by the batch just so you see how weird escaping is (or lack there of):
"C:\Program Files\Splunk\bin\scripts\tester.bat"
"1"
"host="DAMEWARESERVER" sourcetype="WinEventLog:Application" SourceName=dwmrcs EventCode=111 | table _time host User_ID"
"host="DAMEWARESERVER" sourcetype="WinEventLog:Application" SourceName=dwmrcs EventCode=111 | table _time host User_ID"
"Dameware Connections"
"Saved Search [Dameware Connections] number of events(1)"
"http://SPLUNKSERVER:8000/app/search/@go?sid=scheduler__admin__search__RMD562ef57e39918d377_at_1481747700_13613"
"C:\Program Files\Splunk\var\run\splunk\dispatch\scheduler__admin__search__RMD562ef57e39918d377_at_1481747700_13613\results.csv.gz"
---we are testing with two percent variables--
%1
---we are testing with one percent variables--
1
"host^=^'DAMEWARESERVER^'^ sourcetype^=^'WinEventLog:Application^'^ SourceName^=dwmrcs^ EventCode^=111^ ^|^ table^ _time^ host^ User_ID"
"host^=^'DAMEWARESERVER^'^ sourcetype^=^'WinEventLog:Application^'^ SourceName^=dwmrcs^ EventCode^=111^ ^|^ table^ _time^ host^ User_ID"
"Dameware^ Connections"
"Saved^ Search^ ^[Dameware^ Connections^]^ number^ of^ events^(1^)"
"http://SPLUNKSERVER:8000/app/search/@go?sid^=scheduler__admin__search__RMD562ef57e39918d377_at_1481747700_13613"
""
C:\Program
---we are testing with one percent variables embedded in single-quotes embedded in double quotes, semi-color separated--
"'"C:\Program Files\Splunk\bin\scripts\tester.bat"';'1';'"host='DAMEWARESERVER' sourcetype='WinEventLog:Application' SourceName=dwmrcs EventCode=111 | table _time host User_ID"';'"host='DAMEWARESERVER' sourcetype='WinEventLog:Application' SourceName=dwmrcs EventCode=111 | table _time host User_ID"';'"Dameware Connections"';'"Saved Search [Dameware Connections] number of events(1)"';'"http://SPLUNKSERVER:8000/app/search/@go?sid=scheduler__admin__search__RMD562ef57e39918d377_at_1481747700_13613"';'""';'C:\Program'"
---we are testing with asterisk--
1 "host^=^'DAMEWARESERVER^'^ sourcetype^=^'WinEventLog:Application^'^ SourceName^=dwmrcs^ EventCode^=111^ ^|^ table^ _time^ host^ User_ID" "host^=^'DAMEWARESERVER^'^ sourcetype^=^'WinEventLog:Application^'^ SourceName^=dwmrcs^ EventCode^=111^ ^|^ table^ _time^ host^ User_ID" "Dameware^ Connections" "Saved^ Search^ ^[Dameware^ Connections^]^ number^ of^ events^(1^)" "http://SPLUNKSERVER:8000/app/search/@go?sid^=scheduler__admin__search__RMD562ef57e39918d377_at_1481747700_13613" "" C:\Program Files\Splunk\var\run\splunk\dispatch\scheduler__admin__search__RMD562ef57e39918d377_at_1481747700_13613\results.csv.gz
---execute powershell--
Errorlevel = 0
And the powershell output:
C:\Program Files\Splunk\bin\scripts\tester.bat;1;host=DAMEWARESERVER sourcetype=WinEventLog:Application SourceName=dwmrcs EventCode=111 | table _time host User_ID;host=DAMEWARESERVER sourcetype=WinEventLog:Application SourceName=dwmrcs EventCode=111 | table _time host User_ID;Dameware Connections;Saved Search [Dameware Connections] number of events(1);http://SPLUNKSERVER:8000/app/search/@go?sid=scheduler__admin__search__RMD562ef57e39918d377_at_1481747700_13613;C:\Program Files\Splunk\var\run\splunk\dispatch\scheduler__admin__search__RMD562ef57e39918d377_at_1481747700_13613\results.csv.gz
--args[0]---------------
C:\Program Files\Splunk\bin\scripts\tester.bat;1;host=DAMEWARESERVER sourcetype=WinEventLog:Application SourceName=dwmrcs EventCode=111 | table _time host User_ID;host=DAMEWARESERVER sourcetype=WinEventLog:Application SourceName=dwmrcs EventCode=111 | table _time host User_ID;Dameware Connections;Saved Search [Dameware Connections] number of events(1);http://SPLUNKSERVER:8000/app/search/@go?sid=scheduler__admin__search__RMD562ef57e39918d377_at_1481747700_13613;C:\Program Files\Splunk\var\run\splunk\dispatch\scheduler__admin__search__RMD562ef57e39918d377_at_1481747700_13613\results.csv.gz
--args[1]---------------
--args[2]---------------
--args[3]---------------
--args[4]---------------
--args[5]---------------
--args[6]---------------
--args[7]---------------
--args[8]---------------
--args[9]---------------
--args[10]---------------
--args[11]---------------
Parse the semi-color separated $args[0] with -split or something else to determine the fields as described in the documentation: http://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/Configuringscriptedalerts
... View more
11-28-2016
02:50 PM
Hello all,
I can't seem to get Powershell or batch script to "successfully" execute.
When I attempt to run a batch, I receive the following error in splunkd.log:
Error while executing script [Error 193] %1 is not a valid Win32 application
In regards to a powershell script:
If I attempt to run a ps1, even with #!c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe as the first line, the exit code is seemed to be not 0 .
Having changed/added the following to runshellscript.py:
Line 223: beneath the subprocess.popen call under if mswindows: add: output = p.stdout.read()
Line 231: then under if code!=0: modify results = splunk.Intersplunk.generateErrorResults("Script: " + str(output))
I saw an error with runshellscript,py improperly escaping the arguments. Having had a | in my splunk query, runshellscript.py allowed the | to be treated as a command line pipe, not as part of the query.
After removing the pipe from the splunk query (and restoring runshellscript.py to it's original form), powershell seems to exit with code 0 , but my script does not successfully execute/do anything observable.
The scripts are as follows:
tester.bat:
@echo off
echo %SPLUNK_ARG_0% > "C:\program files\splunk\bin\scripts\testbat.out"
echo "bat started" >> "C:\Program Files\Splunk\bin\scripts\testbat.out"
c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -file "C:\Program Files\Splunk\bin\scripts\tester.ps1" %*
echo "bat finishing" >> "C:\Program Files\Splunk\bin\scripts\testbat.out"
tester.ps1
#!c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
#docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Configuringscriptedalerts
$scriptname = $Args[0]
$numberofeventsreturned = $Args[1]
$searchterms = $Args[2]
$fqquerystring = $Args[3]
$nameofreport = $Args[4]
$alerttriggerreason = $Args[5]
$reportbrowserurl = $Args[6]
$gzippedresultsfile = $Args[8]
write-output "start" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
write-output $($args -join ";") >> "C:\Program Files\Splunk\bin\scripts\test.csv"
write-output "done" >> "C:\Program Files\Splunk\bin\scripts\test.csv"
I see some older documentation on Windows script execution in the following locations:
http://wiki.splunk.com/Community:TroubleshootingAlertScripts
http://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/Configuringscriptedalerts
https://answers.splunk.com/answers/171871/powershell-script-triggered-from-alert-is-not-exec.html <== wish it was this simple
However, none of the suggestions are of assistance, and it appears to be an issue directly related to how runshellscript,py is written.
Has anyone had any success executing Alert scripts on Windows with Splunk v6.4.4?
Thank you for your time,
Matt
... View more
11-23-2016
09:22 AM
Thank you! index=_internal source=*scheduler.log status!=success OR NOT INFO savedsearch_name="[name of saved search here]" | dedup reason | table reason In my case, reason == "maxRtsearches limit reached"
... View more
04-27-2016
06:14 AM
Hello,
I've configured the "Add-on for Microsoft Sysmon" (https://splunkbase.splunk.com/app/1914/) and would like to understand how to produce a change report from one day to the next.
For instance, right now I run the following query per day and have a report delivered.
sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 | dedup Hashes | table Hashes Image ParentImage
It isn't of much use, as this just tends to show the same information with every delivery (as it should).
What I'd like to do is produce a report that compares one day to the next and list differences. This would help answer questions like: Did the hash for c:\windows\system32\svchost.exe change? Is there an svchost.exe that has a different hash than one seen before?
I'd love to get to a point where I could have real time alerting:
when the Hash changes but Image stays the same (and correlate to a Windows Update within some period of time).
when a ParentImage changes, but Image stays the same (at least for system processes)
Are either of the above possible?
... View more
03-11-2016
11:22 AM
Thank you!
I like the pipeline structure. I'm assuming that stats is like a class, and count is like a function that just counts whatever's piped in (the returned records)? etc etc with the other members of the pipeline?
Although the "parsing job" step seems to take much longer, it appears that this returns only the events I wish (93), versus a sub-search option that I kludged together from creeping through other answers (returning 1.5 million records):
sourcetype="WinEventLog:Security"
| stats count by host
| search NOT [
search sourcetype="WinEventLog:Security" EventCode=4800
| table host
| dedup host ]
| stats count by host
... View more
03-11-2016
08:59 AM
I'm new to splunk, and logical switch statements have me a bit confused.
I'd like to produce a list of hosts that haven't been locked for 24 hours.
I came across a previous answer (by the name of "Find which hosts a user has not logged in to") that uses eval for this purpose, but I am seeing results where I know the EventCode has been logged
sourcetype="WinEventLog:Security" | stats count(eval(EventCode=4800)) as LockedCount by host | where LockedCount=0
If I walk through this query:
Per host, count all the records where eventcode=4800.
If there are no records counted, list the host.
As stated earlier, hosts where EventCode=4800 are returned with the above query. What am I misunderstanding?
Thanks!
Matt
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
