Hello, I managed the change of the proxy with following modification in $SPLUNK_HOME/etc/apps/TA-etintel/bin/update_repdata.py - Original script - def make_url(authcode, fname): url = 'https://rules.emergingthreatspro.com/{0}/reputation/{1}'.format( authcode, fname) request = Request(url) request.set_proxy('http://<your_proxy>:<your_port>','http') logger.debug("Version is %s", VERSION) agent = "ET-SPLUNK-TA (" + VERSION + ")" logger.debug("User-agent is %s", agent) request.add_header("User-agent", agent) return request - Modified script (adding "request.set_proxy" below line 104) - def make_url(authcode, fname): url = 'https://rules.emergingthreatspro.com/{0}/reputation/{1}'.format( authcode, fname) request = Request(url) request.set_proxy('http://<your_proxy>:<your_port>','http') logger.debug("Version is %s", VERSION) agent = "ET-SPLUNK-TA (" + VERSION + ")" logger.debug("User-agent is %s", agent) request.add_header("User-agent", agent) return request Thank you. ... View more

Also noticing there is a problem in the props.conf with assigning the dest attribute in order to properly assign hostname values for use with the Malware Data Model in ES. If dhost has a value and shost doesn't, the logic in the original props.conf appears to overwrite dest with shost which is null. Added the following to local/props.conf which appears to have resolved it and left the default/props.conf alone. Perhaps this could be incorporated in the next release as well. Thanks [trendmicro] EVAL-dest = case((isnotnull(shost) AND isnull(dhost)),shost,(isnull(shost) AND isnotnull(dhost)),dhost) ... View more

After working thru issue. Splunk_TA_windows from the new install of the UF, and that would over-ride the app of domain_controller because a Capital S takes a higher priority on an app than a lowercase d. Okie ... View more