Added and uploaded to Splunkbase. Not sure how soon it will be visible. ... View more

You would be better off using SEDCMD for this. Something like: props.conf: [api-core] SEDCMD-password-anonymizer = s/(password_new(?:_confirm)?\\?":\s*\\?")([^\\"]+)/\1xxxxxx/g ... View more

Your regex is a little too greedy. Try "FirstName"[=:]"[^"]+" This is using something called a "negated character class". ... View more

Yes, if the data does not have the field, then you will have to ignore them. CIM will populate them as "unknown" in most cases. There are some .conf presentations on CIM (https://conf.splunk.com/files/2017/slides/the-power-of-data-normalization-a-look-at-cim-under-the-hood.pdf, for example). ... View more

Well, you don't do it with props.conf. DBX 3.x uses HEC to talk to itself, and in that conversation the timezone gets baked in, so that props.conf settings won't matter. Instead you have to edit the database connection itself (via GUI or db_connections.conf😞 timezone = <time zone identifier> # optional, default uses JVM time zone # The identifier could be: # an offset from UTC/Greenwich, that uses the same offset regardless given date-time e.g. +08:00 # an area where a specific set of rules for finding the offset from UTC/Greenwich apply e.g. Europe/Paris. So, it has to be set for the whole connection. So if you have a connection that has different tables with timestamps in different timezones, you will have to get creative. ... View more

The Template app is able to do this, provided you create your own TA using it as a base (hence the template part). Can you post some sample data? Edit: Updated with info from the sample data Looks like you found a bug in the template! Here is what I have done to get the onboarding and extractions working correctly, using the CEF template add-on as a base: Prepare your new add-on I downloaded a copy of the add-on from splunkbase, then I renamed it to TA-kasperskylab_securitycenter . Then I opened default/props.conf and changed the stanza from my_sourcetype to kasperskylab:securitycenter . Additionally, I renamed the REPORT extractions as such: REPORT-cefLabelFirst = kasperskylab_cefLabelFirst REPORT-cefLabelSecond = kasperskylab_cefLabelSecond REPORT-builtInCefFields = kasperskylab_builtInCefFields and opened the transforms.conf to match for those. Configure onboarding I configured the sourcetype for onboarding as such: [kasperskylab:securitycenter:cef] MAX_TIMESTAMP_LOOKAHEAD = 10 NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TIME_FORMAT = %s TIME_PREFIX = \|rt= TRUNCATE=999999 Fix that extraction I've uploaded a new version (1.2) to Splunkbase, but it may not be published yet. In the meantime, you can change the following line for the initial extractions from: \sCEF:\d\|(?<vendor>[^\|]+)\|(?<product>[^\|]+)\|(?<product_version>[^\|]+)\|(?<signature_id>[^\|]+)\|(?<signature>[^\|]+)\|(?<vendor_severity>[^\|]+)\|(?<cef_message>.*) to ^CEF:\d\|(?<vendor>[^\|]+)\|(?<product>[^\|]+)\|(?<product_version>[^\|]+)\|(?<signature_id>[^\|]+)\|(?<signature>[^\|]+)\|(?<vendor_severity>[^\|]+)\|(?<cef_message>.*) CIM compliance This fix should get the extractions going as you would like. Note that while this will get you a good start on the CIM fields, it isn't a silver bullet. You will still need to add eventtypes and tags, and may need to add some field aliases or extractions to round out the model with which you decide to work. HTH, Dave Edit: Here's a screenshot of the results: ... View more