@richgalloway I thought the same thing as that did generate an error.  If I simply remove that line, I get the following error: Incomplete string token. + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException + FullyQualifiedErrorId : IncompleteString ... View more

@woodcock What is the best way to modify this script to support the API token approach?  I have tried a few different versions, but am unable to get it to work properly. So....something like:  curl -H "Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2......." ... View more

To be specific, this is the error I am getting now ---- 02-17-2023 11:46:17.588 -0800 WARN X509Verify [7248 HTTPDispatch] - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used. ... View more

So, I think I may have figured out how to resolve this issue...... Since the certificates are self-signed, I needed to edit the line (from the outputs.conf on the UF --- AND  ---- from the inputs.conf on the HF):  current >>>> sslVerifyServerCert = true new >>>> sslVerifyServerCert = false What I need to figure out now is how to get these signed with a legitimate CA.  I am assuming there are certs installed on the Splunk HF/UF instances that I can use to sign with --- any help/links would be appreciated.   ... View more

@PickleRick That seems to work. Thank you! ... View more

@PickleRick So, here is my revised inputs.conf based on your feedback: [WinEventLog://Microsoft-Windows-PowerShell/Operational] disabled = 0 index = windows evt_resolve_ad_obj = 1 checkpointInterval = 5 renderXml = false whitelist = 4103,4104 blacklist.1 = EventCode="4103" Message="SplunkUniversalForwarder\\bin\\splunk-powershell" However, this log is still being indexed:     ... View more

@PickleRick Short answer is yes --- the logs for those events do not show up in an indexed search.  splunkd.log does throw an error stating what you are referring to.   01-26-2023 09:57:45.534 -0800 ERROR ExecProcessor [25044 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - Processing: 'blacklist1', failed to find key in string data ' "+*SplunkUniversalForwarder\\bin\\splunk-powershell*+"'   Any ideas as to the correct regex logic to filter the issue I am facing? ... View more

All --- thank you for your insight thus far.  Unfortunately, the issue still persists despite trying a number of different approaches.  The current blacklists (included in the screenshot below) are successful in that they are able to filter out events (such as those shown in the sample log --- also shown below). Note: I do not have the Windows TA installed on the endpoint on which this blacklist is published (only upstream on my HA and Splunk Cloud hosted environment). inputs.conf  [WinEventLog://Microsoft-Windows-PowerShell/Operational] disabled = 0 index = windows evt_resolve_ad_obj = 1 checkpointInterval = 5 renderXml = false whitelist = 4103,4104 blacklist1 = EventCode="4103" "+*SplunkUniversalForwarder\\bin\\splunk-powershell*+" blacklist2 = EventCode="4104" "+*SplunkUniversalForwarder\\bin\\splunk-powershell*+"  Log 01/26/2023 09:57:53 AM LogName=Microsoft-Windows-PowerShell/Operational EventCode=4104 EventType=5 ComputerName=COMPUTER.acme.corp User=SYSTEM Sid=S-1-5-18 SidType=1 SourceName=Microsoft-Windows-PowerShell Type=Verbose RecordNumber=10689125 Keywords=None TaskCategory=Execute a Remote Command OpCode=On create calls Message=Creating Scriptblock text (1 of 1): { [void]$batch.Add($_) if ($batch.Count -ge $batchSize) { $batchAndStanza = [System.Tuple]::Create($batch.ToArray(), $stanza) [void]$serializingQueue.Add($batchAndStanza) [void]$batch.Clear() } } ScriptBlock ID: b3e9c4de-ea6b-445a-a3af-31131f9337a7 Path: C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell-common.ps1   Where this strategy falls apart is with the log example below where the field containing this data contains other data as well (not just the file path in question).  Is there an approach here with regards to RegEx and blacklisting that will work?  If so, can you provide such? 01/26/2023 11:06:05 AM LogName=Microsoft-Windows-PowerShell/Operational EventCode=4103 EventType=4 ComputerName=COMPUTER.acme.corp User=SYSTEM Sid=S-1-5-18 SidType=1 SourceName=Microsoft-Windows-PowerShell Type=Information RecordNumber=10710308 Keywords=None TaskCategory=Executing Pipeline OpCode=To be used when operation is just executing a method Message=CommandInvocation(Start-Sleep): "Start-Sleep" ParameterBinding(Start-Sleep): name="Milliseconds"; value="200" Context: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.2364 Host ID = 669eaf0a-e3f8-4a4a-ba5c-07aaa7cbf8bf Host Application = powershell.exe -command & {get-content C:\WINDOWS\TEMP\\input20898122fee20402.tmp | C:\Program` Files\SplunkUniversalForwarder\bin\splunk-powershell.ps1 C:\Program` Files\SplunkUniversalForwarder 20898122fee20402} Engine Version = 5.1.19041.2364 Runspace ID = 5291985e-c02c-4052-9465-91ab0c5a7989 Pipeline ID = 1 Command Name = Start-Sleep Command Type = Cmdlet Script Name = Command Path = Sequence Number = 47702 User = ACME\SYSTEM Connected User = Shell ID = Microsoft.PowerShell     ... View more

@richgalloway Definitely not working as-is.  I have tried several different iterations of this using a variety of syntax.  In some cases the events continue to flow in as if I had not applied any filtering and in other cases no events with code 4103 come in at all (even though I am not targeting such a broad set of data).  I just can't seem to get it right and was hoping there was an easy answer. Alternatively, I am open to using ingest actions --- but am less familair with using those.  Does using these only affect my license or would this approach prevent the data from being indexed at all (to whatever would have been the destination index in the first place)?   My goal here is that these events are in the end not searchable via the destination index at all. If ingest actions are not going to get me to my end state, I am back to using blacklists and am hoping for some ideas.     ... View more

@richgalloway I think the below is as close as I will get for now.  I can forgo the "Netbios" since I have the DNS name in my vuln data as well as the IP.  It would be a nice to have in the future, but not a deal breaker.   `get_tenable_index` sourcetype="tenable:io:vuln" [ search index="tenable" sourcetype="tenable:io:assets" deleted_at="null" | rename uuid AS asset_uuid | stats count by asset_uuid | fields asset_uuid ] | rename plugin.id AS Plugin_ID asset_uuid AS Asset_ID port AS Network_Port | strcat Asset_ID : Plugin_ID : Network_Port Custom_ID_1 | strcat Asset_ID : Plugin_ID Custom_ID_2 | stats latest(*) as * by Custom_ID_1 | search state!="fixed" | search severity!="informational" | eval unixtime=strptime(first_found,"%Y-%m-%dT%H:%M:%S") | eval mydate=strftime(unixtime,"%Y-%m-%d") | rename plugin.cvss_base_score AS CVSS plugin.synopsis AS Description dns_name AS DNS_Name ip AS IP_Address plugin.name AS Name plugin.cve{} AS CVE output AS Output severity AS Risk plugin.see_also{} AS See_Also plugin.solution AS Solution state AS State plugin.publication_date AS Plugin_Publish_Date mydate AS First_Found | table Custom_ID_2, CVSS, Description, DNS_Name, IP_Address, Name, CVE, Plugin_ID, Output, Risk, See_Also, Solution, State, Asset_ID, First_Found ... View more

  Seems to be working so far, so thank you for the help! One last question and we can wrap this up.   `get_tenable_index` sourcetype="tenable:io:vuln" [ search index="tenable" sourcetype="tenable:io:assets" deleted_at="null" | rename uuid AS asset_uuid netbios_name AS Netbios_Name | stats count by asset_uuid | fields asset_uuid ] | rename plugin.id AS Plugin_ID asset_uuid AS Asset_ID port AS Network_Port | strcat Asset_ID : Plugin_ID : Network_Port Custom_ID | stats latest(*) as * by Custom_ID | search state!=fixed | search severity!=informational | rename plugin.cvss_base_score AS CVSS plugin.synopsis AS Description plugin.name AS Name plugin.cve{} AS CVE output AS Output severity AS Risk plugin.see_also{} AS See_Also plugin.solution AS Solution state AS State plugin.has_patch AS Patchable plugin.exploit_available AS Exploitable plugin.exploited_by_malware AS Exploited_By_Malware plugin.publication_date AS Plugin_Publish_Date synopsis AS Synopsis first_found AS First_Found | table CVSS, Description, Name, Plugin_ID, Output, Risk, See_Also, Solution, Synopsis, State, Asset_ID, First_Found     How do I pull in a field value from a subsearch into the last table command?  I included the field "netbios" into the example above. That data is not returned in the main search. Thank you in advance! ... View more

The short of it is that we gave up on the parsing and decided to leverage "Splunk Stream" for DNS.  We have had zero issues with the approach to date and have gotten the data we are looking for in terms of the query itself as well as the resulting response.  The fields you want to collect are configurable which means less data to ingest into Splunk (vs the parsing/filtering that had to be done at search time). Happy to discuss further, so let me know. ... View more

@PickleRick This seems to work --- any reason why I would not want to use this approach?   index=tenable sourcetype=tenable:io:vuln severity!=informational state!=fixed [ search index=tenable sourcetype=tenable:io:assets deleted_at=null | rename uuid AS asset_uuid | stats count by asset_uuid | fields asset_uuid | format ] | fields "plugin.cvss_base_score" "plugin.synopsis" "plugin.name" "plugin.cve{}" "plugin.id" "output" "severity" "plugin.see_also{}" "plugin.solution" "state" "asset_uuid" "plugin.has_patch" "plugin.exploit_available" "plugin.exploited_by_malware" "plugin.publication_date" | table "plugin.cvss_base_score" "plugin.synopsis" "plugin.name" "plugin.cve{}" "plugin.id" "output" "severity" "plugin.see_also{}" "plugin.solution" "state" "asset_uuid" "plugin.has_patch" "plugin.exploit_available" "plugin.exploited_by_malware" "plugin.publication_date"   ... View more

@PickleRick  First of all thank you for your time.  It is appreciated. Looked over your suggestions.  What I am not understanding is --- if the goal here is to take each unique "uuid" value (the number of unique asset_uuid values varies anywhere from 1 to x depending on the search time/scope) from the list of assets and return only vulnerabilities that contain that uuid value (so essentially running this search as a "foreach" loop of sorts), how am I getting there? This initial search returns all vulnerabilities and all assets within the defined period of time. ("index"="tenable" "sourcetype"="tenable:io:vuln" "severity"!="informational" "state"!="fixed" earliest=-14d) OR (index=tenable sourcetype=tenable:io:assets earliest=-30d) This will effectively return (among other data) all uuid and asset_uuid values (which we later create a common field name for), but does not consider that I only want to return vulnerabilities where the "asset_uuid" value exists in the "uuid" value.  Maybe I am missing something. ... View more

@PickleRick Just following up to see if you have any thoughts as to how to build out this search.  Thank you. ... View more

=====Asset Data Example===== {"has_agent": true, "has_plugin_results": true, "created_at": "2021-10-28T14:59:21.964Z", "terminated_at": null, "terminated_by": null, "updated_at": "2022-04-06T00:43:11.746Z", "deleted_at": null, "deleted_by": null, "first_seen": "2021-10-28T14:59:21.583Z", "last_seen": "2022-04-06T00:43:11.416Z", "first_scan_time": "2021-10-28T14:59:21.583Z", "last_scan_time": "2022-04-06T00:43:11.416Z", "last_authenticated_scan_date": "2022-04-06T00:40:40.971Z", "last_licensed_scan_date": "2022-04-06T00:40:40.971Z", "last_scan_id": "6cb1cf79-fabb-4b4b-b81f-d96894adbe9e", "last_schedule_id": "template-306ed309-a776-3ef5-87d2-8eb812a47148f389d609ffeb46dc", "azure_vm_id": null, "azure_resource_id": null, "gcp_project_id": null, "gcp_zone": null, "gcp_instance_id": null, "aws_ec2_instance_ami_id": null, "aws_ec2_instance_id": null, "agent_uuid": "3ed6e2d25f4f4501a403a66bd020ae08", "bios_uuid": "3e34f54c-2220-11b2-a85c-92d15106ac6c", "network_id": "00000000-0000-0000-0000-000000000000", "network_name": "Default", "aws_owner_id": null, "aws_availability_zone": null, "aws_region": null, "aws_vpc_id": null, "aws_ec2_instance_group_name": null, "aws_ec2_instance_state_name": null, "aws_ec2_instance_type": null, "aws_subnet_id": null, "aws_ec2_product_code": null, "aws_ec2_name": null, "mcafee_epo_guid": null, "mcafee_epo_agent_guid": null, "servicenow_sysid": null, "bigfix_asset_id": null, "agent_names": ["laptop"], "installed_software": ["cpe:/a:microsoft:edge:99.0.1150.30", "cpe:/a:google:chrome:100.0.4896.75"], "ipv4s": ["10.10.10.10"], "ipv6s": ["fe80:0:0:0:fdb9:6512:39dd:89d4"], "fqdns": ["laptop.acme.corp"], "mac_addresses": ["02:50:41:00:00:01"], "netbios_names": ["laptop"], "operating_systems": ["Microsoft Windows"], "system_types": ["general-purpose"], "hostnames": ["laptop"], "ssh_fingerprints": [], "qualys_asset_ids": [], "qualys_host_ids": [], "manufacturer_tpm_ids": [], "symantec_ep_hardware_keys": [], "sources": [{"name": "NESSUS_AGENT", "first_seen": "2021-10-28T14:59:21.583Z", "last_seen": "2022-04-06T00:43:11.416Z"}], "tags": [{"uuid": "ebf9b183-2cb4-48a7-ad6d-fad4ac224f99", "key": "WINDOWS", "value": "WINDOWS_LAPTOPS", "added_by": "c637bc33-8454-4b4e-9e32-6cda9841933e", "added_at": "2021-11-02T17:50:24.722Z"}, {"uuid": "cdad26ea-159a-40ff-bf14-0f6d1c6fa1e5", "key": "DBLN_AGENT", "value": "MOBILE", "added_by": null, "added_at": "2022-03-29T17:00:14.712Z"}], "network_interfaces": [{"name": "Ethernet 5", "virtual": null, "aliased": null, "fqdns": ["laptop.acme.corp"], "mac_addresses": ["02:50:41:00:00:01"], "ipv4s": ["10.10.10.10"], "ipv6s": []}, {"name": "Wi-Fi", "virtual": null, "aliased": null, "fqdns": ["l-laptop.acme.corp"], "mac_addresses": ["cc:d9:ac:cd:6d:4c"], "ipv4s": ["10.10.10.10"], "ipv6s": []}, {"name": "UNKNOWN", "virtual": null, "aliased": null, "fqdns": ["laptop.acme.corp"], "mac_addresses": ["5c:ff:35:c3:70:8b", "02:50:41:00:00:01", "cc:d9:ac:cd:6d:4c", "00:2b:67:db:b0:c4", "cc:d9:ac:cd:6d:50", "ce:d9:ac:cd:6d:4c", "cc:d9:ac:cd:6d:4d"], "ipv4s": ["10.10.10.10"], "ipv6s": ["fe80:0:0:0:fdb9:6512:39dd:89d4"]}], "IO_address": "cloud.tenable.com", "state": "Active", "uuid": "028c406e-1c0c-466b-a703-0a5612bb8b07"}   =====Vulnerability Data Example===== {"output": "output here", "plugin": {"checks_for_default_account": false, "checks_for_malware": false, "cpe": ["cpe:/a:microsoft:teams"], "cvss3_base_score": 0.0, "cvss3_temporal_score": 0.0, "cvss_base_score": 0.0, "cvss_temporal_score": 0.0, "description": "Description here.", "exploit_available": false, "exploit_framework_canvas": false, "exploit_framework_core": false, "exploit_framework_d2_elliot": false, "exploit_framework_exploithub": false, "exploit_framework_metasploit": false, "exploited_by_malware": false, "exploited_by_nessus": false, "family": "Windows", "family_id": 20, "has_patch": false, "id": 144792, "in_the_news": false, "name": "Name here", "modification_date": "2022-03-30T00:00:00Z", "publication_date": "2021-01-07T00:00:00Z", "risk_factor": "None", "see_also": ["http://www.nessus.org", "https://docs.microsoft.com"], "solution": "N/A", "synopsis": "Synopsis here.", "type": "local", "unsupported_by_vendor": false, "version": "1.42"}, "port": {"port": 0, "protocol": "TCP"}, "scan": {"completed_at": "2022-04-06T00:36:51.238Z", "schedule_uuid": "template-306ed309-a776-3ef5-87d2-8eb812a47148f389d609ffeb46dc", "started_at": "2022-04-06T00:00:38.528Z", "uuid": "6cb1cf79-fabb-4b4b-b81f-d96894adbe9e"}, "severity": "informational", "severity_id": 0, "severity_default_id": 0, "severity_modification_type": "NONE", "first_found": "2021-08-11T01:07:12.920Z", "last_found": "2022-04-06T00:36:51.238Z", "state": "open", "indexed": "2022-04-06T00:37:26.908Z", "IO_address": "cloud.tenable.com", "asset_uuid": "028c406e-1c0c-466b-a703-0a5612bb8b07", "asset_fqdn": "laptop.acme.corp", "agent_uuid": "971d45e109d84c33b04be05302e07419", "ipv4": "10.10.10.10", "ipv6": null, "vendor_severity": "info"}   ====Current Splunk Search===== "index"="tenable" "sourcetype"="tenable:io:vuln" "severity"!="informational" "state"!="fixed" earliest=-14d [ search index=tenable sourcetype=tenable:io:assets earliest=-30d | stats values(uuid) as asset_uuid ] | eval output = replace (output, "[\n\r]"," ") | rename "plugin.cvss_base_score" AS "CVSS" "plugin.synopsis" AS "Description" "plugin.name" AS "Name" "plugin.cve{}" AS "CVE" "plugin.id" AS "Plugin_ID" "output" AS "Output" "severity" AS "Risk" plugin.see_also{} AS "See_Also" "plugin.solution" AS "Solution" "state" AS "State" "asset_uuid" AS "Asset_ID" "plugin.has_patch" AS "Patchable" plugin.exploit_available AS "Exploitable" plugin.exploited_by_malware AS "Exploited_By_Malware" plugin.publication_date AS "Plugin_Publish_Date" | strcat Asset_ID ":" Plugin_ID Custom_ID | table "asset_fqdn", "CVSS", "Description", "Name", "CVE", "Plugin_ID", "Output", "Risk", "See_Also", "Solution" , "State", "Asset_ID", "Custom_ID", "Patchable", "Exploitable", "Exploited_By_Malware" | dedup "Custom_ID"   ===Comments==== This field is the one I want to additionally filter on (in the above example): "value": "WINDOWS_LAPTOPS" This field could have multiple values (in the example it does not). The value is not limited by name in the example --- could be "WINDOWS_DESKTOPS" for example. ... View more