About efheem

efheem · ‎11-29-2023

Just in case if someone is still looking for an answer to this, go to ES Threat Intelligence Management and click New ->TAXII Url : https://otx.alienvault.com/taxii/collections Post Arguments: collection=user_AlienVault taxii_username=xxxxxxxxxxxxxyourAPIKeyHerexxxxxxxxx taxii_password=foo Cheers!

efheem · ‎11-02-2023

Hello, I am having a hard time with the Splunk Universal Forwarder agent v9.1.1. Got it installed in 100+ servers and it starts and talks to the deployment server , then when I push some configs, it restarts and never comes back. To make it start again, the windows admin had to remove the credentials of Splunk user from the host. I tried installing the agent in multiple ways and even tried using virtual account and experienced the same results Default installation : msiexec.exe /i splunkforwarder-9.1.1-64e843ea36b1-x64-release.msi AGREETOLICENSE=yes DEPLOYMENT_SERVER=some_url:8089 SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 /quiet Using Virtual account without password: msiexec.exe /i splunkforwarder-9.1.1-64e843ea36b1-x64-release.msi AGREETOLICENSE=yes DEPLOYMENT_SERVER=some_url:8089 SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 SPLUNKUSERNAME=splunkfwd USE_VIRTUAL_ACCOUNT=1 /quiet Using Virtual account with password: msiexec.exe /i splunkforwarder-9.1.1-64e843ea36b1-x64-release.msi AGREETOLICENSE=yes DEPLOYMENT_SERVER=some_url:8089 SERVICESTARTTYPE=auto LAUNCHSPLUNK=1 SPLUNKUSERNAME=splunkfwd SPLUNKPASSWORD=some_password USE_VIRTUAL_ACCOUNT=1 /quiet Any thoughts on what could be the issue? Splunk log does not show any anything. And just to add this this, it works fine in some hosts (~5) without any issues

efheem · ‎09-18-2023

I figured out why this was throwing the error and posting here the solution just in case if it help someone. I was sure that I did not use any IP's while configuring the instances, however, I just noticed that when I used cluster manager URI in server.conf for searchhead mode, it picked the IP address of peers (default behavior I think) instead of fqdn. The cert SAN did not had IP address in it. To overcome this, I added the below line in server.conf in each cluster peer and it resolved the issue. [clustering] register_search_address = FQDN

efheem · ‎09-11-2023

Hello, When I enable sslVerifyServerCert in server.conf under [sslConfig], I am seeing the following errors. From where does it understands that there is an IP address mismatch? If it trying to resolve the CN mentioned in the certificate? 09-11-2023 11:40:01.284 +0300 WARN X509Verify [1034989 TcpChannelThread] - Server X509 certificate (CN=searche.test.local,OU=NIL,O=TEST,L=Loc,ST=Sta,C=NIL) failed validation; error=64, reason="IP addrsearche mismatch" 09-11-2023 11:40:01.285 +0300 WARN X509Verify [1034990 TcpChannelThread] - Server X509 certificate (CN=searche.test.local,OU=NIL,O=TEST,L=Loc,ST=Sta,C=NIL) failed validation; error=64, reason="IP addrsearche mismatch" 09-11-2023 11:40:01.286 +0300 WARN X509Verify [1034986 TcpChannelThread] - Server X509 certificate (CN=searche.test.local,OU=NIL,O=TEST,L=Loc,ST=Sta,C=NIL) failed validation; error=64, reason="IP addrsearche mismatch" 09-11-2023 11:40:03.998 +0300 WARN X509Verify [1034777 DistHealthReporter] - Server X509 certificate (CN=searche.test.local,OU=NIL,O=TEST,L=Loc,ST=Sta,C=NIL) failed validation; error=64, reason="IP addrsearche mismatch" 09-11-2023 11:40:03.998 +0300 WARN X509Verify [1034786 DistributedPeerMonitorThread] - Server X509 certificate (CN=searche.test.local,OU=NIL,O=TEST,L=Loc,ST=Sta,C=NIL) failed validation; error=64, reason="IP addrsearche mismatch" 09-11-2023 11:40:04.005 +0300 WARN X509Verify [1034777 DistHealthReporter] - Server X509 certificate (CN=searche.test.local,OU=NIL,O=TEST,L=Loc,ST=Sta,C=NIL) failed validation; error=64, reason="IP addrsearche mismatch" Cheers.

efheem · ‎10-11-2022

Hello, I am trying to come-up with something which will automatically enrich the events using the country information using the src_ip field in the events. I understand that the iplocation command can do this in search time. Is there any way we can get this done automatically using props.conf? I am expecting to have a lookup file which we can leverage to achieve this and I cannot find any. Cheers.

efheem · ‎12-24-2020

Hello, I have the below use case to detect Cleartext Passwords at rest | from datamodel:"Compute_Inventory"."Cleartext_Passwords" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(tag) as "tag",count by "dest","user","password" This datamodel runs the below search query (`cim_Compute_Inventory_indexes`) tag=inventory (tag=cpu OR tag=memory OR tag=network OR tag=storage OR (tag=system tag=version) OR tag=user OR tag=virtual) tag=user password=* But I am not getting any results. There are events like below which says password=x (I know its fetching from /etc/passwd) and not cleartext password, but still, I do not see any results when I do a pivot. Can someone please tell me why? When I remove password=* and do a preview, I see password=x. Password is properly being extracted as a separate field when I run the query for its sourcetype and index.

efheem · ‎08-06-2019

Hello @richgalloway, I have figured it out. I had to do a clean-up and reinstall as there was some left overs from my previous cluster configurations. Many thanks for your help, I got it working now.

efheem · ‎08-06-2019

Thank you for your response, when I try to do this I get the following error, is this because I dont have a license? "Encountered the following error while trying to save: Error while sending public key to search peer: Connection reset by peer" Many thanks.

efheem · ‎08-06-2019

Hello, I have installed two Splunk instances and I want to dedicate one as a search head and other as an Indexed. Please can someone guide me how to configure search head to use a separate Index server? Thanks, efheem

Posts	9
Solutions	1
Karma Given	1
Karma Received	1
Member Since	‎08-06-2019

Online Status	Offline
Date Last Visited	‎11-29-2023 08:21 AM

Spunk UF agent does not restart in Windows

Why are there Splunk SSL Errors when setting sslVe...

Is there a way to enrich events by having country ...

Splunk ES - Detect Cleartext Passwords search not ...

How to seperate indexer and search head?

Re: Splunk ES taxii feed - AlienVault OTX config