About Funderburg78

Funderburg78 · ‎05-19-2023

https://conf.splunk.com/files/2019/slides/FN1190.pdfFN1190.pdf (splunk.com)

Funderburg78 · ‎06-23-2022

There are a couple things that need to be performed to Audit Command given in a CLI for Windows: one, follow the below instructions to add Command Line auditing to process execution: We are looking to satisfy the narratives for AU-3(1) and AU-6(8) which specifically talk about capturing full-text of privileged commands. Linux is easy, monitor each user’s .history file. Windows is a little more annoying: https://docs.microsoft.com/en-us/powershell/scripting/windows-powershell/wmf/whats-new/script-logging?view=powershell-7.2 https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-windows-command-line-auditing-february-10-2015-570edc4b-8ee7-950d-4629-045e308743e4 Now to address what if a user uses Powershell instead of widows CMD. See the following Articles: How to Use PowerShell Transcription Logs in Splunk - Hurricane Labs Solved: How to monitor Powershell Command Line history? - Splunk Community Once you have the data you can search for EventID 4688 for all objects run using administrator Accounts and grab the command line information. PowerShell is a slightly different beast still but Looking through the data you will find ways to identify Get Commands and Set commands. Karma is appreciated if this helps

Funderburg78 · ‎03-15-2022

Glad to hear it bro!

Funderburg78 · ‎10-26-2021

Did you find what issue caused this or get it resolved? I have a 14 server system at 2 sites running a multi-site cluster and all my servers upgraded successfully except one of my Search heads.

Funderburg78 · ‎09-07-2021

I am also having this issue but only one one of 6 splunk servers. The other Splunk servers do not have a tracker.log. This log is not listed in: https://docs.splunk.com/Documentation/Splunk/8.2.2/Troubleshooting/Enabledebuglogging#log-local.cfg as a splunk log so I wonder if it has something to be done with the upgrade. It has been 1 week since my upgrade and this is the only server complaining. Would really like to know what this log is and why it is having issues. I checked file permissions and it is the same as the other logs.... This log is in /var/spool/splunk and is a default to be monitored in the /splunk/etc/system/default/inputs.con and is listed as a latency tracker. of my 6 servers only the search head running ES even has this log in the director y

Funderburg78 · ‎07-09-2021

Looks like I need to use a powershell script or logparser to do the conversion. I found some stuff on the internet to help with this for those who may have this issue in the future! Convert evtx Files: Powershell Try: $a = Get-Item *.evtx $output_file = [System.IO.StreamWriter] $("all.csv") foreach($file in $a){ $events = get-winevent -path $file.FullName foreach ($Event in $events) { $xml = [xml]($Event.ToXml()) foreach ($s in $xml.Event.System.ChildNodes) { $output_file.Write($s.Name + ":" + $s.InnerText + ",") } foreach ($d in $xml.Event.EventData.Data) { $text = $d.InnerText $text = if ($text) { $text.replace("`n","") } else { $text } $output_file.Write($d.Name + ":" + $text + ",") } $output_file.WriteLine() } } $output_file.Flush() $output_file.Close() LogParser: (Download from Microsoft.com) $logparser = "c:\program files (x86)\Log Parser 2.2\logparser.exe"$query = "SELECT * INTO c:\logs\logs.csv FROM c:\logs\logs.evtx" & $logparser -i:evt -o:csv $query I have not actually tried this yet, but will be giving it a shot in the near future, I expect some tweaking to the scripting may need to be required. EDIT: Links for reference: https://serverfault.com/questions/783708/convert-saved-evtx-files-to-text LogParser Download location: https://www.microsoft.com/en-us/download/details.aspx?id=24659

Funderburg78 · ‎07-09-2021

I have unzipped the logs already to a directory C:\EventLogs\Restore. It is literally 50+ evtx files. The monitor://C:\EventLogs\Restore\* does not appear to be working. Normally with Windows logs you need to use the wineventlog:// tool, however, it makes a conenction to a channel to monitor the channel. Since these are not in a channel it will not work. Since they are evtx files I am not sure the monitor:// can actually read it. If they were .csv or .log I am sure monitor:// would work fine. I was wondering if there is something Splunk has to tackle this challenge. I really do not want to mount them all manually and convert them to csv files manually. that would take forever... EDIT: I cannot be the only person to install splunk and have there customer want to ingest old backed up evtx files....

Funderburg78 · ‎07-08-2021

Prior to a customer getting splunk, they 7-zipped there logs and copied them to a server. I just got them a brand new Splunk 8.2.1 enterprise system stood up with awesome dashboards. Now the customer is asking if I can import there archived .evtx files. Do we do this by just putitng them in a folder and using monitor to point at them?

Funderburg78 · ‎07-07-2021

index!=_* returns all data from all indexes except the Splunk system indexes. Now that you know you have data, try: index!=_* "fail*" AND "password"

Funderburg78 · ‎07-07-2021

I figured it out for those curious: | rex field=domain mode=sed "s/$\d+$/./g"

Funderburg78 · ‎07-07-2021

After modifying apps, I strongly suggest you uninstall and redploy the app.

Funderburg78 · ‎07-07-2021

try typing: index=* sourcetype=linux_secure I think your problem is splunk often wants an index unless you have default index lookups configured in splunk which seeing you are in fundamentals 1, you probably do not. ig that does not work, try just typeing: index!=_* This should return any data in any index except for splunk specific logs data. This will tell you for sure you have some data or not. Also, then see if in the interesting columns under sourcetype, you see the sourcetype you are looking for.

Funderburg78 · ‎07-07-2021

since I do not have the lab guide, maybe if you post the query you typed in we can see if there is a mistake.

Funderburg78 · ‎07-07-2021

Even better question, I recently learned python, how do I take what I learned and use it in splunk? Explanation links to articles are fine answers! Yes, I give Karma!

Funderburg78 · ‎07-07-2021

What if the value being replaced was from DNS Query logs like: (3)windows(12)live(2)com(7) and sometimes (4)live(7)windows(4)update(13)com(4) The goal of course to replace (\d+) with a "." anywhere it appears in the field. I can easily replace the leading and trailing (\d) using rex to strip them from the field so it looks like: windows(12)live(2)com or live(7)windows(4)update(13)com how can I then use mode=sed to convert it to windows.live.com and/or live.windows.update.com? Sometimes the domain name is 10+ word.word.word.owrd in length and it is variable.

Funderburg78 · ‎06-22-2021

I will try adapting this tomorrow and let you know if I have any issues 😛 Thanks so much for the reply. If it works I will mark it as a solution as well. In the meantime, Karma for the starting point 😛

Funderburg78 · ‎06-22-2021

yeah, you should not have that inputs.conf in your Splunk/apps/splunkuniversalforwarder directory. When you redeployed the app to the client, did you uninstall it first, then ensure the restart splunk button was checked? I would check your clients splunkhome/etc/app/windows_TA/local/inputs.conf and verify it got the updated config, then restart splunk on the client. Also, i assume yhou ensured the client has an outputs.conf. if you uninstalled your custom app and it had the outputs.conf then that is why it is not sending logs to the indexer.

Funderburg78 · ‎06-22-2021

you need to identify the LAT and LONG. Ordinarily splunk will perform a whois call and determine the lat/long of the domain the ip is associated with if connected to the internet. If you want to do this differently, I think you need to apply lat/long yourself. I do not believe there is an automatic lookup. there are a couple ways you can accomplish this. You can build your own lookup table to convert addresses to a lat/long or you can just input the lat/long directly into the data if it is something like a spreadsheet. For reading about chloropleth maps: https://www.splunk.com/en_us/blog/tips-and-tricks/mapping-with-splunk.html

Funderburg78 · ‎06-22-2021

The transforms and props.conf have to be in the same application as the inputs.conf. Instead of using a custom app, have you tried putting your inputs.conf into the local directory of the Windows_TA? so in Windows_TA\Local\inputs.conf This is what the local directory was for. you can use the windows_TA but only enable the inputs you want, or even modify the settings for the inputs to put them in different indexes. I would be careful not to mess with the sourcetypes, make sure you leave the defaults as this is how the props.conf and transforms.conf idenitifes what to data to apply the settings to. I see you have no sourcetypes listed in the above inputs.conf this may be a part of your problem. Either way, do not use a seperate app for inputs, jsut copy the inputs.conf from the default directory of the windows_TA to the local directory and only enable the features you want.

Funderburg78 · ‎06-22-2021

So in python coding you can use rrule to assign weekends in weeks and subtract them from your calculation. I ask because I am getting a Ticket open dat, and a ticket close date and I am attempting to determine SLA values based on working days (i.e.; we are not open weekends and are only open 6am-6pm) for tickets that span nights or weekends, how can i remove those time values dynamically for data that is being automatically pulled from a ticket system and not using a static value like an excel spreadsheet. i.e.; This needs to be able to continue updating as time goes.... Bonus points if you can help account for a 6am - 6pm workday for SLA timers... Bonus bonus if you know how to exclude holidays, LOL

Funderburg78 · ‎06-16-2021

Upon reading: https://docs.splunk.com/Documentation/Splunk/latest/Data/Configureeventlinebreaking#Configure_event_line_breaking I am curious to ask if adding data from the Splunk enterprise GUI, is it possible to use the line breaker to break the data or does it HAVE to be done via a props.conf BEFORE the data is ingested by the indexer? Can the props.conf be put on the indexer if I am using a universal forwarder instead of a heavy forwarder for the host? I am trying to build a props.conf on the search head to merge the lines for already ingested data if that is possible, If not, Then I will fix it pre-ingestion and just not be able to add the old data.... BTW, here is what my data Looks Like AGENT:,Domain\pcName,,,,User:,Domain\userName, 01/01/2020 15:00:00,,File Copied, ,Z:\filename.ext,,, \device\harddiskvolume0 seagate anotherword 0000,220.2 ,,,To:,Y:\fileName.ext,,, \device\harddiskvolume1 seagate anotherword 0000,220.2 01/01/2020 15:00:00,,File Copied, ,Z:\filename2.ext,,, \device\harddiskvolume0 seagate anotherword 0000,220-2 ,,,To:,Y:\fileName2.ext,,, \device\harddiskvolume1 seagate anotherword 0000,220.2 01/01/2020 15:00:00,,File Copied, ,Z:\filename3.ext,,, \device\harddiskvolume0 seagate anotherword 0000,220-2 ,,,To:,Y:\fileName3.ext,,, \device\harddiskvolume1 seagate anotherword 0000,220.2 AGENT:,Domain\pcName2,,,,User:,Domain\userName2, 01/01/2020 15:00:00,,File Copied, ,Z:\filename4.ext,,, \device\harddiskvolume0 seagate anotherword 0000,220.2 ,,,To:,Y:\fileName4.ext,,, \device\harddiskvolume1 seagate anotherword 0000,220.2 01/01/2020 15:00:00,,File Copied, ,Z:\filename5.ext,,, \device\harddiskvolume0 seagate anotherword 0000,220-2 ,,,To:,Y:\fileName5.ext,,, \device\harddiskvolume1 seagate anotherword 0000,220.2 01/01/2020 15:00:00,,File Copied, ,Z:\filename6.ext,,, \device\harddiskvolume0 seagate anotherword 0000,220-2 ,,,To:,Y:\fileName6.ext,,, \device\harddiskvolume1 seagate anotherword 0000,220.2 Basically, every time it gives a new PC and user, that is the start of a new Event, the rest of the lines should be a part of the same event. Otherwise, I would like to copy the pcname and username and attach it to ever event that belongs to it. the goal is to see what user and pc is transferring what date from one HD to another HD. I do not control the system sending the data to change its format.

Funderburg78 · ‎04-16-2021

Randomly stopped ingesting data about 2 weeks ago. I tried installing it on a seperate front end to see if it will start importing data again and it wont. I am using Security Center.sc 5.14.1 it was working fine for a little over a month. When I change the input I see it authenticate to tenable with the User credentials. But the automated timer to start the job does not appear t oever kick off in I express in seconds, or if I do it using chron format. It was working fine using Chron 15 */1 * * *. I tried moving to 3600. Changed start time to blank.... Any ideas?

Funderburg78 · ‎04-06-2021

FYI This has been resolved. Turns out if you utilize the [sslConfig] serverca = servercerts = Then the KVStore no longer uses server.pem and instead uses the certs assigned in the sslConfig. This was not mentioned anywhere in Documentation. If this post helps you later please extend some Karma 😛

Funderburg78 · ‎04-06-2021

What he said above.... However, if you want to display the timestamp in Human readable then I would do a | sort -timestamp | table TIMESTAMP

Funderburg78 · ‎03-30-2021

This really depends on your router manufacturer. You could easily google something like: Linksys LRT224 syslog configuration (https://community.linksys.com/t5/Linksys-Small-Business/Syslog-setting-for-LRT224/td-p/1346325) so pointing your router to your syslog server (Or splunk directly if it is the only syslog device and you enabled the port on your splunk server) should get you what you need.

Posts	36
Solutions	1
Karma Given	5
Karma Received	6
Member Since	‎10-11-2019

Online Status	Offline
Date Last Visited	‎05-19-2023 12:02 PM

How can I ingest windows logs that were backed up

Is there a way to have a duration value account fo...

Event Line Breaking

Tenable add-on for Splunk v4.0.1

Why am I experiencing KVStore Failure using Red Ha...

Re: Splunk forwarder behind a one way data diode. ...

Re: How to monitor privileged commands in Windows?

Re: KVStore Failure

Re: Splunk upgrade fails from 7.3.2 to 8.1.2 and r...

Re: Ingestion Latency after updating to 8.2.1

Re: How can I ingest windows logs that were backed...

Re: How can I ingest windows logs that were backed...

How can I ingest windows logs that were backed up

Re: Splunk Fundamentals Module 5

Re: How to write rex with sed mode so that it show...

Re: Windows TA App not Extracting properly

Re: Splunk Fundamentals Module 5

Re: Splunk Fundamentals Module 5

Re: Reload changed python code without restarting ...

Re: How to write rex with sed mode so that it show...

Re: Is there a way to have a duration value accoun...

Re: Windows TA App not Extracting properly

Re: Splunk Maps plotting using physical address (n...

Re: Windows TA App not Extracting properly

Is there a way to have a duration value account fo...

Event Line Breaking

Tenable add-on for Splunk v4.0.1

Re: KVStore Failure

Re: Issue using sort command with inputlookup comm...

Re: Sending router data to splunk for analysis