About tiaatim

tiaatim · ‎09-11-2020

Hi, I'm following the zoom logging instructions and have everything configured. I'm ready to put in the exception for the firewall change but I'm not sure of the incoming URL from Zoom. Is it just https://zoom.marketplace.us/user/ or should there be some designation of the company's account or user's name in that URL? I've looked everywhere and can't find a specific answer. I don't want to put in a firewall request and then it not be right so figured someone here may have done this and know for sure. Thanks!

tiaatim · ‎07-22-2020

I thought about that too but then the datamodel wouldn't populate and the data wouldn't be CIM compliant.

tiaatim · ‎07-22-2020

I was thinking about that, but the field already exists in the DM though so I don't want to modify how it is populated for our firewall logs. If I turned that field into a calculated field then the existing duration value in the FW data would be lost and wouldn't populate the field with fw logs right?

tiaatim · ‎07-22-2020

I have a search that evals out a calculation from other fields to a "Duration" field for netflow data. Is there a way to populate duration in the network traffic datamodel with the results of the calculation? It currently has firewall data in it but I'd like to add netflow as well. Thanks!

tiaatim · ‎05-26-2020

Hey guys, we have Enterprise Security and the Endpoint data model never finishes building. I even knocked the backfill range to 4 hours and it still doesn't complete. I know there is a TON of data and even when I run the base macro used in all of the datasets it takes forever to run just in a 15 minute window. We just moved over a to a brand new index cluster with 10 indexers and don't see any performance issues anywhere else other than this one last data model that won't complete building.

tiaatim · ‎05-04-2020

Did you ever figure this out? I'm experiencing the same issue.

tiaatim · ‎04-09-2020

Thanks. One output is UDP/514 and the other is TCP/9997 to Splunk indexers. I've been looking to see how I can performance tune the NIC but where would I see that they are being blocked? I see a bunch of reset errors on the NIC btw.

tiaatim · ‎03-14-2020

They are sending a syslog feed to a 3rd party temporarily via a syslog statement in the outputs.conf. So the HF's are sending to our indexers via regular Splunk:TCP 9997 and also routing out syslog UDP:514. I found the issue though, the HF's were just overwhelmed with too much data and I offloaded some logsources to another HF.

tiaatim · ‎03-11-2020

taking the load balance out of the equation. One HF is going to one VIP and the other to a different VIP, not load balancing from the HF to the F5's. Apologies for the confusion.

tiaatim · ‎03-11-2020

I have 2 heavy forwarders receiving UF logs from about 2000 windows servers. The traffic is being split to our indexers and with a route out via syslog to 2 F5 VIPs. For a specific server I see about 500k logs in 24 hours in Splunk. But on the receiving end of the syslog there are only 14 events. I'm pretty sure the HF's are overloaded and I've put in a request to have 2 more built, but I'm also wondering if there is any further tuning I can do. I am not finding anything specific to HF's online. Thanks.

tiaatim · ‎03-05-2020

I tested this and couldn't get it to work so going a different route.

tiaatim · ‎03-04-2020

Thanks, I've seen that but it doesn't specifically state that you can go from HF to HF uncooked.

tiaatim · ‎03-04-2020

Hi, I have a scenario where I need to forward data from a HF to another HF but I need it to be uncooked so the receiving HF can also forward to a 3rd party. Is this possible? Thanks!

tiaatim · ‎02-04-2020

Yes, I did restart Splunk. I didn't comment out test_group1 this time but did before I made this specific change and saw data going to group2. Thanks for your help.

tiaatim · ‎02-04-2020

I tried the above config and unfortunately it didn't work. It still only sent to one IP address. Here is the outputs.conf that I tried: [syslog] defaultGroup = syslog:test_group1,syslog:test_group2 type = udp priority = NO_PRI [syslog:test_group1] server = 10.x.x.1:514 [syslog:test_group2] server = 10.x.x.2:514

tiaatim · ‎02-04-2020

Thanks, so do something like this? [syslog] defaultGroup = syslog:test_group1, syslog:test_group2 type = udp priority = NO_PRI [syslog:test_group1] server = 10.X.X.1:514 [syslog:test_group2] server = 10.X.X.2:514

tiaatim · ‎02-04-2020

Currently the 2 VIPs are on one F5. We had one VIP going to a 2 IP pool but saw that traffic was only going to a single IP in the pool. So we are now trying 2 VIPs with the 2 IPs in the pool's flipped so the first VIP goes to .3 and .4 in the pool and the second VIP goes to .4 and .3 in the pool. Make sense?

tiaatim · ‎02-04-2020

No, the indexers are receiving the data via standard Splunk indexer port 9997. I'm sending via syslog to the F5 because thats the way the host behind the VIPs wants to see it.

tiaatim · ‎02-04-2020

They are wineventlog - app/sec/sys They are coming in to the HF via UF. The data gets sent to an index cluster via another app/stanza on the HF and they look fine in Splunk. Thanks!

tiaatim · ‎02-04-2020

We are on 7.2.5.1. My outputs is sending incoming Windows logs out to 2 F5 VIPs via a syslog stanza. The data is going out and only ever hits the first vip in the server= line in the stanza [syslog:test_group] priority = NO_PRI server = 10.X.X.1:514,10.X.X.2:514 type = udp The .1 is receiving all of the data on the F5 and the HF never seems to switch over to the .2 IP. Any help would be greatly appreciated.

tiaatim · ‎11-08-2019

Looks like the reason why is because these settings in local/inputs.conf under the ESS app were disabled. [app_imports_update://update_es] disabled = 1 [app_imports_update://update_es_da] disabled = 1 [app_imports_update://update_es_main] disabled = 1 Thanks again for your help!

tiaatim · ‎11-07-2019

Thanks for your help dflodstrom, I was able to fix it. For some reason the cisco-asa TA was missing in the /opt/splunk/etc/apps/Splunk_SA_CIM/metadata/local/meta file. I added it and everything is working and my datamodel is building.

tiaatim · ‎11-07-2019

tiaatim · ‎11-07-2019

I see all of those tags when I do a search in Search and Reporting on the ES SH. But when I'm in the ES app and do a search none of the tags are there. In Settings > Tags if I select Search and Reporting in the dropdown I see all of those tags. But when I select ES in the dropdown selector, I don't see any of those tags. Almost like they didn't make it over from the S&R app for some reason.

tiaatim · ‎11-07-2019

I checked the sharing for the ASA TA and it's set to "all apps". one thing I noticed is when I go on my ES SH and go to tags, under Search and Reporting app the tags are different than under Enterprise Security app. Same with eventttypes. So it looks like somehow the objects aren't getting shared across the apps. I removed the ASA app and reinstalled and still the same thing... On the app imports update screen only sideview_utils are exclused and for inclusion only DA_ESS_PCICompliance and DA-ESS_contentupdate are showing... Thanks for your help!

Posts	27
Solutions	1
Karma Given	2
Karma Received	2
Member Since	‎05-14-2019

Online Status	Offline
Date Last Visited	‎10-26-2020 02:16 PM

Zoom Logging - Firewall Question

Add result of eval to datamodel field

Endpoint Data model does not finish building.

Heavy Forwarders Dropping Logs

Can I send uncooked data from one HF to another?

Heavy Forwarder Load Balancing syslog data to F5 V...

Splunk Enterprise Security: Cisco ASA logs extract...

Zoom Logging - Firewall Question

Re: Add result of eval to datamodel field

Re: Add result of eval to datamodel field

Add result of eval to datamodel field

Endpoint Data model does not finish building.

Re: CEF parsing on under Splunk Enterprie Security...

Re: Heavy Forwarders Dropping Logs

Re: Heavy Forwarders Dropping Logs

Re: Heavy Forwarders Dropping Logs

Heavy Forwarders Dropping Logs

Re: Can I send uncooked data from one HF to anothe...

Re: Can I send uncooked data from one HF to anothe...

Can I send uncooked data from one HF to another?

Re: Heavy Forwarder Load Balancing syslog data to ...

Re: Heavy Forwarder Load Balancing syslog data to ...

Re: Heavy Forwarder Load Balancing syslog data to ...

Re: Heavy Forwarder Load Balancing syslog data to ...

Re: Heavy Forwarder Load Balancing syslog data to ...

Re: Heavy Forwarder Load Balancing syslog data to ...

Heavy Forwarder Load Balancing syslog data to F5 V...

Re: Splunk Enterprise Security: Cisco ASA logs ext...

Re: Splunk Enterprise Security: Cisco ASA logs ext...

Re: Splunk Enterprise Security: Cisco ASA logs ext...

Re: Splunk Enterprise Security: Cisco ASA logs ext...

Re: Splunk Enterprise Security: Cisco ASA logs ext...