Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About hassanali
hassanali
Explorer
Member since:
11-01-2016
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-01-2016 |
Activity Feed
- Got Karma for Re: OPSEC LEA Forwarder prerequisites. 06-06-2021 07:49 AM
- Posted Re: Cisco eStreamer for Splunk: Why am I receiving "ERROR: There is no Defense Center defined" after configuration? on All Apps and Add-ons. 12-21-2016 10:18 PM
- Posted Re: My Splunk Add-on for Check Point OPSEC LEA configuration works on an indexer, but why not on a heavy forwarder? on All Apps and Add-ons. 12-05-2016 12:36 PM
- Posted Re: How to install the Splunk Add-on for Checkpoint OPSEC LEA in a search head clustering environment? on All Apps and Add-ons. 12-05-2016 12:03 PM
- Posted Re: OPSEC LEA Forwarder prerequisites on Deployment Architecture. 12-05-2016 11:57 AM
- Posted Re: How to deploy the Splunk Add-on for Check Point OPSEC LEA in a multisite indexer cluster? on Deployment Architecture. 11-29-2016 07:44 PM
- Posted My Splunk Add-on for Check Point OPSEC LEA configuration works on an indexer, but why not on a heavy forwarder? on All Apps and Add-ons. 11-29-2016 02:13 PM
- Tagged My Splunk Add-on for Check Point OPSEC LEA configuration works on an indexer, but why not on a heavy forwarder? on All Apps and Add-ons. 11-29-2016 02:13 PM
- Tagged My Splunk Add-on for Check Point OPSEC LEA configuration works on an indexer, but why not on a heavy forwarder? on All Apps and Add-ons. 11-29-2016 02:13 PM
- Tagged My Splunk Add-on for Check Point OPSEC LEA configuration works on an indexer, but why not on a heavy forwarder? on All Apps and Add-ons. 11-29-2016 02:13 PM
- Tagged My Splunk Add-on for Check Point OPSEC LEA configuration works on an indexer, but why not on a heavy forwarder? on All Apps and Add-ons. 11-29-2016 02:13 PM
- Posted Cisco eStreamer for Splunk: Why am I receiving "ERROR: There is no Defense Center defined" after configuration? on All Apps and Add-ons. 11-01-2016 05:03 PM
- Tagged Cisco eStreamer for Splunk: Why am I receiving "ERROR: There is no Defense Center defined" after configuration? on All Apps and Add-ons. 11-01-2016 05:03 PM
- Tagged Cisco eStreamer for Splunk: Why am I receiving "ERROR: There is no Defense Center defined" after configuration? on All Apps and Add-ons. 11-01-2016 05:03 PM
- Tagged Cisco eStreamer for Splunk: Why am I receiving "ERROR: There is no Defense Center defined" after configuration? on All Apps and Add-ons. 11-01-2016 05:03 PM
Topics I've Started
12-21-2016
10:18 PM
Yes.
I was able to get it fixed by re-installing the app.
... View more
12-05-2016
12:36 PM
The port that is being used to send traffic is not the problem. I was testing multiple add-ons and using separate ports helps me disable indexing.
The problem is with the events not being forwarded, the same configuration works for indexing but not when I try to forward events.
... View more
12-05-2016
12:03 PM
Hi javiergn, I am also trying to install the latest version of OPSEC on a HF but I am not seeing any events being forwarded to the Indexer.
I am assuming you had to add an outputs.conf (standard configuration, forward events to a port and on the indexer listen in on the port).
1) Are there any other changes you had to make to the ?
opseclea_connection.conf
opseclea_inputs.conf
2) Did you make any changes on the indexer? (i am assuming you have the app installed on the indexer)
Thanks !
... View more
12-05-2016
11:57 AM
1 Karma
I can not find any documentation specifically addressing the install on a HF. I have gathered from reading answers by the community to not index on the HF (common sense but documentation does not address what to add in the inputs.conf), assuming the outputs.conf is straight forward but then the app configuration on the indexer is also not clear.
... View more
11-29-2016
07:44 PM
I was having the same problem. We do have a heavy forwarder, however, when the documentation is not very clear on how to setup the HF setup. When I configure as I would on an Indexer and just add an outputs.conf it is not working.
... View more
11-29-2016
02:13 PM
I am trying to deploy the Splunk Add-on for Check Point OPSEC LEA on a heavy forwarder and the configuration is not working. I tried it on the indexer directly and it worked, but when I try to configure it on the forwarder with the same setup as the one on indexer with an added outputs.conf that sends data to port 5515, it doesn't work.
I am assuming I need to then only listen on 5515 at the Indexer.
... View more
11-01-2016
05:03 PM
I am using Splunk 6.4 and the Cisco eStreamer for Splunk app. When I follow the steps to install the app and connect to Defense Center by:
1) Generate certificate in Defense Center, import to Splunk indexer
2) Edit estreamer.conf to provide
i) Defense Center IP
ii) certificate path
iii) provide password (none in my case)
3) Configure eStreamer app from within Splunk with similar parameters
I am not able to get the events streaming. The error that I get is "ERROR: There is no Defense Center defined."
... View more
