About swong2

nomad899 · ‎10-06-2021

How didi you resolve this?

swong2 · ‎10-22-2020

Hi, I wanted to know if it is possible to set up just one credential (i.e. one client id and key from one main tenant) and use it to pull Azure audit as well as subscription resources from other organization's tenants. I am looking into the multi-tenant application registration way to accomplish it. I am also using the following Azure related add-ons and wanted to use one single secret key to do the jobs. - Splunk Add-on for Microsoft Cloud Services - Microsoft Azure Add-on for Splunk - Microsoft Graph Security Add-on for Splunk I would appreciate any insight and point me to the right direction to do this.

swong2 · ‎09-19-2018

I believe the problem is in config file splunk/etc/apps/TA-Demisto/default/restmap.conf Validation [validation:savedsearch] action.demisto.param.occured = validate( match('action.demisto.param.occured', "((^[0-9]*$)|(\$trigger_time\$?)$)"), "Enter valid epoch time for duration")

swong2 · ‎08-09-2018

Yes I am using version 1.0.3 Microsoft Azure Active Directory Reporting Add-on for Splunk https://splunkbase.splunk.com/app/3757/

ajayshikant2782 · ‎10-22-2018

I was having the same issue but only running the code directly from Azure (inside an Azure Website). I solved upgrading 'Microsoft.IdentityModel.Clients.ActiveDirectory' package to '2.6.1-alpha'. Linksys Support Should you have any suggestions, please let me know.

btorresgil · ‎05-08-2018

Thanks for reporting this. I filed an issue here: https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks/issues/74 This fix will be included in Palo Alto Networks App 6.0.2. In the meantime you can workaround this issue by making the following change: https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks/commit/0c595b16e14b190419448213b45c5d50e8830a64

swong2 · ‎01-02-2018

Hi Brian, any fix or workaround for this issue without upgrading the TA to 6.0.x?

smitra_splunk · ‎03-21-2019

is it the mscs:azure:audit sourcetype ?

panguy · ‎12-04-2017

This issue is resolved in version 6.0.0 of the App.

esix_splunk · ‎02-25-2015

Bundles are bound by the GUID of the search head initiating the search. There should be no collision of name / bundle space as the GUID's are unique, unless you have modified the configuration of the search heads so that they have the same GUIDs.

Posts	17
Solutions	0
Karma Given	0
Karma Received	4
Member Since	‎02-03-2015

Online Status	Offline
Date Last Visited	‎04-01-2024 06:20 PM

Qualys Technology Add-on 1.8.4 - Password update i...

Splunk Add-on for Microsoft Cloud Services: Mult...

Using the Demisto Add-on, why am I getting the fol...

Microsoft Azure Template for Splunk App randomly s...

Palo Alto Networks App for Splunk 6.0.1: "panuseru...

Palo Alto Networks App for Splunk 5.3.1: "panconte...

Is there any plan to pull Azure Security Center lo...

Palo Alto Networks App for Splunk 5.0: Why does th...

Will the distributed knowledge bundles from differ...

Re: Qualys Technology Add-on 1.8.4 - Password upda...

Splunk Add-on for Microsoft Cloud Services: Mult...

Re: Using the Demisto Add-on, why am I getting the...

Re: Microsoft Azure Template for Splunk App random...

Re: New version 1.0.3 gives a request error when q...

Re: Palo Alto Networks App for Splunk 6.0.1: "panu...

Re: Palo Alto Networks App for Splunk 5.3.1: "panc...

Re: Is there any plan to pull Azure Security Cente...

Re: Palo Alto Networks App for Splunk 5.0: Why doe...

Re: Will the distributed knowledge bundles from di...