@manjunathmeti Sorry to bother you again -
I've given it a try, but then noticed that my "search_name" attribute is always NULL, and I don't have a "user" attribute at all in the json object passed in from stdin - is there some additional settings I need to change?
Also tried passing in a param.name="$name$" when triggering sendalert but there's still no value...(however param.test="$app$" & "$owner$" worked, although they're giving the name of the app & "system" rather than username and alertname...)
Now I'm thinking using the action.. override in savedsearches,conf to hard code the alertname, but is there any way to figure out the username?
Thanks in advance!
... View more
I have an alert action that triggers a python script;
In the intended workflow, this alert action can either
1. be manually executed by a user, or
2. be scheduled to execute as an alert action of several different alerts
How can I pass
1. the username that manually runs the search in case 1, and
2. the name of the alert that triggered this alert action
into the python script itself?
E.g. if user Alice@zzz.com runs
search xxx | sendalert alert_action_1
I want to use the variable "Alice@zzz.com" in the python script;
and if "Alert_ABC" triggers the action alert_action_1,
I want to use the variable "Alert_ABC" in the python script
I've got fields like "_raw" working, but couldn't find any parameters related to what/who triggered the alert action itself...
Any hints would be really appreciated!
... View more
We're using a simplified version of the Splunk_TA_nix app (basically just a subset of the bash scripts) to collect system metrics such as CPU memory disk usages;
It works well, but the problem is that these bash commands are constantly triggering our auditd rules on the end point (which is configured to monitor for execve syscalls), at an extremely high rate. E.g. every 30 seconds, one of these bash scripts executes, which triggers ~ 20 audit events, resulting in 100+ audit records, just from the sed, awk, tee, wc etc. commands within the script, which get fed back into splunk via the other auditd app we have (the amount of data generated from this is huge - larger than normal system activities in general).
One solution we're considering is to filter out audit records with auid=-1 from the audit rules side (with the tradeoff of losing some visibility);
Another approach is to rewrite all these bash scripts in python or some compiled languages so that it doesn't trigger that many execve syscalls;
Third option is to filter out the specific commands generated by these scripts;
Does anyone else have a similar problem? What's the best way to deal with this kind of issues? Is there another good app that serves a similar purpose but does not use bash (using python / C etc. instead)?
Any info is really appreciated!
... View more