About ojay

ojay · ‎04-25-2023

Hi, thank you for your feedback. The add-on is installed on indexer, searchheads and universal forwarder. However fields like below are not beeing mapped 00/00/0000 00:00:00 PM LogName=Application EventCode=33205 EventType=0 ComputerName= SourceName=MSSQLSERVER Type=Information RecordNumber=123456 Keywords=Audit Failure, Classic TaskCategory=Logon OpCode=None Message=Audit event: audit_schema_version:1 event_time:2023-00-00 00:00:00.000000 sequence_number:1 action_id:LGIF succeeded:false is_column_permission:false session_id:0 server_principal_id:0 database_principal_id:0 target_server_principal_id:0 target_database_principal_id:0 object_id:0 user_defined_event_id:0 transaction_id:0 class_type:LX permission_bitmask:00000000000000000000000000000000 sequence_group_id: session_server_principal_name: server_principal_name: server_principal_sid: database_principal_name: target_server_principal_name: target_server_principal_sid: target_database_principal_name: server_instance_name:XXXXXXXXXX database_name: schema_name: object_name: statement: additional_information: user_defined_information: Should all fields not be extracted, as the add-on has these field extractions. Or does it only work with dbconnect? Hopefully somebody can support and advise before I start working on a customized solution which I am trying to avoid.

ojay · ‎02-17-2023

Hi all, I am trying to integrate MS SQL audit log data with a UF instead of DB Connect. What is the best and recommended way to do it that maps all fields? At the moment it is integrated with the UF and using the "Splunk Add-on for Microsoft SQL Server" With that the MS SQL events can be identified by SourceName=MSSQLSERVER or SourceName=MSSQL* However it does not work properly work as most of the fields are not extracted and mapped. For example the user is also not translated User= NOT_TRANSLATED

ojay · ‎02-09-2023

What was your conclusion? Which method did you use?

ojay · ‎12-19-2022

Hi Andreas, thank you for the quick response. Does this mean you did the mapping and field extraction all by yourself for? Best, O.

ojay · ‎12-07-2022

Hi all, is there an existing add-on that I can use for getting HPE iLO data into splunk? I am planning on ingesting it with a universal forwarder from a central server used as a repository. Thank you, O.

ojay · ‎05-30-2022

Hi all, I am using "Cisco Cloud Security Umbrella Addon for Splunk" to ingest the Data via API. https://splunkbase.splunk.com/app/5557/ Unfortunately the add-on does not include any CIM knowledge. Can anyone tell me if there is a supported or working add-on for the CIM Mapping? Thank you O.

ojay · ‎05-02-2022

@gcusello wrote: Hi @splunkcol, Yes, you can configure an intermediate forwarder ("Heavy") to work as a concentrator to send logs to the Indexers; this is the usual architecture when you have Splunk Cloud but it can be used also for Splunk on Premise. At first you need at least two Heavy Forwarders (not one), to avoid Single Points of Failure in your architecture. Then, you have to divide your inputs in three classes: logs from server (Windows or Linux it's the same), syslogs, Databases. For the first item, at first you should define if you can install an agent (Universal Forwarder) on the target server or not. If yes you can configure your Universal Forwarders to send logs to the Heavy Forwarders and Splunk guarantees Load Balancing and Fail Over. If you cannot use Universal Forwarder you have to use : WMI to take logs from Windows servers, syslogs to take logs from Linux Servers. My hint is: try always to use Universal Forwarder for many reasons: Easy to manage, more secure (WMI requires Domain credentials), more efficient (UF encrypts and compress packets before sending to HF); no lost data (there's a local cache when connection with Indexers is blocked). For syslogs, you have to use (in addition to the two Heavy Forwarders) a Load Balancer to distribute load between HFs and manage Fail Over, if you haven't you can use a DNS Policy. For DB, if you have to take logs from files you can use the solution for servers with UF; if you have to tale logs from tables, you have to install on both the HFs the DB-Connect App and configure it. Ciao. Giuseppe How do I set up and configure the loadbalancing of the Universal Forwarder between the two Heavy Forwarder? - Is a 3rd party loadbalancer advised? Or can the Universal Forwarder manage themselves? - Is it advised that the Heavy Forwarder are in an active passive mode? What possibilities are there?

ojay · ‎04-19-2022

Hi there, what method did you end up using? Any experience that you can share? O.

ojay · ‎03-31-2022

Hi all, I am using a Heavy Forwarder for a few API related integration Methods of various data sources. I have to consider an integration with HEC Integration now for a new source. Is it possible to use a Heavy Forwarder and add a HEC input to it? Or should a HEC be a seperate machine? Best, O.

ojay · ‎03-24-2022

Hi all, I am ingesting Cisco FTD logs and currently using the Cisco ASA add-on which works fine for a lot of event messages. Unfortunately it is not working perfect as there is one event message that is not getting recognized by the add-on. What Splunk supported method is the best for a standardized onboarding with full CIM knowledge? I do not want to use the estreamer as it is mostly creating issues and is not Splunk supported. Currently used: "Splunk_TA_cisco-asa-4.2.0" Best O.

ojay · ‎03-01-2022

Does anyone know all the azure instances IP or URL that I need to establish a connectivity with?

ojay · ‎02-28-2022

Hi all, I'm trying to set up the Splunk Ad-On for Microsoft O365 https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configuretenant When adding a tenant I receive an error message: "ConnectionResetError 104" What could be the reason? What are all the required Azure URL's that need to be connected by the add-on? Thank you in advance

ojay · ‎02-21-2022

Okay, but what does that look like? Does it have a common scheme? *.management.azure.com or *.graph.azure.com? And where do i find it?

ojay · ‎02-17-2022

Hi, I'm setting up the splunk add-on for o365 and as stated in the Splunk documentation i have to allow the communication from the add-on to the Azure servers. How do i find which azure server this would be? Make sure that port 443 is open to allow the Splunk Add-on for Microsoft Office 365 to communicate with the Microsoft Azure servers. Best regards, J.

ojay · ‎02-08-2022

Hi, I'm planning a new splunk architecture and was thinking about placing the syslog-ng on the same virtual machine as the Heavy Forwarder to read the files locally. How will a large data volume impact the performance or stability? What do i need to consider for memory and diskspace if i combine? When is this advised to seperate to a dedicated syslog-ng server? Will a dedicated syslog-ng server allow for more syslog traffic? Would it be beneficial to install a Universal Forwarder on the HF for local file reading? Is it more advised for better data buffering? Thank you, Jay

ojay · ‎02-04-2022

In case i use both add-on's do I need to create two seperate application integrations?

ojay · ‎02-03-2022

Thank you for the quick feedback, the guide is helpful but i was more looking into a comparison about what add-on to use. Is the "Splunk Add-on for Microsoft Cloud Services" able to get the O365 data? Is it advised to use it?

ojay · ‎02-02-2022

Hi all, I am planning on integrating o365 and Azure cloud services to my Splunk on-prem environment. Now there are several Add-Ons to choose from in Splunkase Microsoft Azure Add on for Splunk Splunk Add-on for Microsoft Office 365 Splunk Add-on for Microsoft Cloud Services What is the main difference between these Add-Ons and which should i use? The documentation did not really help. "The Splunk Add-on for Microsoft Office 365 replaces the modular input for the Office 365 Management API within the Splunk Add-on for Microsoft Cloud Services." Is it still possible to collect the o365 logs with the Cloud Services add-on which collects via so called event hubs? Thank you, O.

ojay · ‎01-27-2022

Hi, I'm planning on using LDAP user authentication for a mid size Splunk Enterprise environment. Reading through the splunk documentation Im getting confuse don what is the minimum required information needed to set it up. Config files vs Splunk Web Is the the bindDN and bindDN password required or just optional? Is the set up through Splunk Web different from set up by config files? Cause i do see differences in the optional fields LDAPS If I setup LDAPS meaning using SSL, what are the steps that need to be done? Do I need to use certificates? and where do these need to be placed? Thank you Oj.

ojay · ‎01-20-2022

Thanks everyone, i have decided to create something like "technology_vendor" Jay

Posts	37
Solutions	0
Karma Given	7
Karma Received	1
Member Since	‎05-06-2021

Online Status	Offline
Date Last Visited	‎04-25-2023 11:06 AM

MS SQL audit logs with UF to read Windows Applicat...

What add-on can I use for integration of HPE iLO l...

Is there a supported or working CIM Mapping add o...

HEC Input on a existing and used Heavy Forwarder?

What add-on for Cisco Firepower syslog (excluding ...

Why am I receiving error when adding tenant to Mic...

How to locate Port for o365 add-on

Planning new Splunk Architecture- placing Syslog-n...

Which add-on for o365 and Azure log collection?

set up LDAP user authentication

Re: MS SQL audit logs with UF to read Windows Appl...

MS SQL audit logs with UF to read Windows Applicat...

Re: MS SQL Audit Logs DB Connect vs UF Event Logs

Re: What add-on can I use for integration of HPE i...

What add-on can I use for integration of HPE iLO l...

Is there a supported or working CIM Mapping add o...

Re: Intermediate forwarder

Re: Cisco Firepower Estreamer Questions