About nick_currie

nick_currie · ‎08-15-2024

Hi Rick - thanks for the reply. I think forwarder management is supported as I have a deployment server running on the same instance - i have created server classes and deployed app's via this so that aspect appears to be working. My plan was to run stream forwarder on the all in 1 instance and deploy the Splunk_TA_Stream app to my UF's. Should this be possible?

nick_currie · ‎08-15-2024

Hi there, i have a small lab at home on which I am running splunk enterprise 9.0.0 build 6818ac46f2ec and a developer license. The Licensing » Installed licenses page shows 3 valid licenses with the following information: . Splunk Enterprise Term Non-Production License creation_time 2024-08-11 07:00:00+00:00 expiration_time 2025-02-11 07:59:59+00:00 features Acceleration AdvancedSearchCommands AdvancedXML Alerting ArchiveToHdfs Auth ConditionalLicensingEnforcement CustomRoles DeployClient DeployServer FwdData GuestPass KVStore LocalSearch MultifactorAuth NontableLookups RcvData RollingWindowAlerts SAMLAuth ScheduledAlerts ScheduledReports ScheduledSearch ScriptedAuth SigningProcessor SplunkWeb SubgroupId SyslogOutputProcessor is_unlimited False label Splunk Enterprise Term Non-Production License max_violations 5 notes None payload None quota_bytes 53687091200.0 sourcetypes stack_name enterprise status VALID type enterprise window_period 30 Splunk Forwarder creation_time 2010-06-20 07:00:00+00:00 expiration_time 2038-01-19 03:14:07+00:00 features Auth DeployClient FwdData RcvData SigningProcessor SplunkWeb SyslogOutputProcessor hash FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD is_unlimited False label Splunk Forwarder max_violations 5 notes None payload None quota_bytes 1048576.0 sourcetypes stack_name forwarder status VALID type forwarder window_period 30 Splunk Free creation_time 2010-06-20 07:00:00+00:00 expiration_time 2038-01-19 03:14:07+00:00 features FwdData KVStore LocalSearch RcvData ScheduledSearch SigningProcessor SplunkWeb hash FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF is_unlimited False label Splunk Free max_violations 3 notes None payload None quota_bytes 524288000.0 sourcetypes stack_name free status VALID type free window_period 30 I would like to experiment with Splunk Stream for capturing DNS records before implementing in our production environment. I have installed Splunk Stream 8.1.3 and most of the menu's within the app work, however when I go to Configuration > Distributed Forwarder Management it just displays a blank page. When i look at the splunk_app_stream.log I can see the following error 2024-08-15 14:51:58,543 ERROR rest_indexers:62 - failed to get indexers peer Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_app_stream/bin/rest_indexers.py", line 55, in handle_GET timeout=splunk.rest.SPLUNKD_CONNECTION_TIMEOUT File "/opt/splunk/lib/python3.7/site-packages/splunk/rest/__init__.py", line 612, in simpleRequest raise splunk.LicenseRestriction splunk.LicenseRestriction: [HTTP 402] Current license does not allow the requested action 2024-08-15 14:51:58,580 ERROR indexer:52 - failed to list indexers Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_app_stream/bin/splunk_app_stream/models/indexer.py", line 43, in get_indexers timeout=splunk.rest.SPLUNKD_CONNECTION_TIMEOUT File "/opt/splunk/lib/python3.7/site-packages/splunk/rest/__init__.py", line 669, in simpleRequest raise splunk.InternalServerError(None, serverResponse.messages) splunk.InternalServerError: [HTTP 500] Splunkd internal error; [] Does this mean that the splunk dev license does not support Splunk Stream app?

nick_currie · ‎03-16-2023

Ok thanks Rick - What worked for this was EventCode="4673" Keywords=".*Failure" Thanks for your help!

nick_currie · ‎03-15-2023

No what i mean is that the regex does not seem to work for me on the Keywords field. Have you tried?

nick_currie · ‎03-15-2023

Further testing has shown i can filter with regex on the Message field - such as this to filter out any msedge events. blacklist = EventCode="4673" Message=".*Edge" The issue is that the Message field does not contain whether it is successful or not. That information is only within the Keywords field of the fields that the UF is supposed to be able to blacklist with.. Is this a bug or do I need to do this another way? I dont want to have to send all of this traffic back to a HF to filter it as we have some mobile devices that send logs directly to splunk cloud so as not to require the VPN.

nick_currie · ‎03-15-2023

Thanks for the suggestions however none of them work - i have tried both of those as well as various other options combinations - with and without quotes on the eventcode and on the keywords statement blacklist = EventCode=4673 Keywords=Audit\sFailure blacklist = EventCode=4673.*Keywords=Audit Failure what i have discovered is that I can blacklist the entire event easily enough by using blacklist = EventCode="4673" but when i try to blacklist the event without quotes it doesnt work. However I would like to keep the successful events in splunk - has anyone else managed this and is willing to share their configuration?

nick_currie · ‎03-15-2023

Im looking to drop EventID 4673 where the action=failure Here is an example log 3/15/2023 02:51:42 PM LogName=Security EventCode=4673 EventType=0 ComputerName=redacted SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=redacted Keywords=Audit Failure TaskCategory=Sensitive Privilege Use OpCode=Info Message=A privileged service was called. Subject: Security ID: redacted Account Name: redacted Account Domain: redacted Logon ID: redacted Service: Server: Security Service Name: Process: Process ID: xxxxx Process Name: C:\Windows\System32\backgroundTaskHost.exe Service Request Information: Privileges: SeTcbPrivilege From reading https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/Inputsconf?_ga=2.40401506.1999669205.1678852413-817152181.1624861549&_gl=1*s1kmhp*_ga*ODE3MTUyMTgxLjE2MjQ4NjE1NDk.*_ga_5EPM2P39FV*MTY3ODg2MDY5OS44Ni4xLjE2Nzg4NjA3NjAuNjAuMC4w#Event_Log_allow_list_and_deny_list_formats I can see that action is not a valid field to filter on? # Valid keys for the key=regex format: * The following keys are equivalent to the fields that appear in the text of the acquired events: * Category, CategoryString, ComputerName, EventCode, EventType, Keywords, LogName, Message, OpCode, RecordNumber, Sid, SidType, SourceName, TaskCategory, Type, User So i chose to use Keywords which has the value Audit Failure Here is my inputs.conf --------------------- [WinEventLog://Security] disabled = 0 index=corp_oswinsec current_only=1 evt_resolve_ad_obj=0 checkpointInterval = 5 blacklist1 = EventCode="4673" Keywords="Audit Failure" -------------------------------- I am still seeing these events being indexed however - any tips on where i am going wrong would be much appreciated!

nick_currie · ‎08-02-2022

Hi there - hopefully someone can help with this: I am trying to deploy sysmon via a deployment app however it looks like the script is having some issues: I can see the following error from the splunkd logs: 08-03-2022 10:54:32.982 +0800 ERROR ExecProcessor [15204 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\CONF_corp_sysmon\bin\deploy.bat"" Sharing violation I can run the script manually with no issues. Any idea's would be much appreciated! The deploy.bat file is as follows: IF EXIST "C:\Program Files (x86)" ( SET BINARCH=Sysmon64.exe SET SERVBINARCH=Sysmon64 ) ELSE ( SET BINARCH=Sysmon.exe SET SERVBINARCH=Sysmon ) SET SYSMONDIR=C:\windows SET SYSMONBIN=%SYSMONDIR%\%BINARCH% SET SYSMONCONFIG=%SYSMONDIR%\config.xml SET GLBSYSMONBIN="%programfiles%\splunkuniversalforwarder\etc\apps\CONF_corp_sysmon\bin\%BINARCH%" SET GLBSYSMONCONFIG="%programfiles%\splunkuniversalforwarder\etc\apps\CONF_corp_sysmon\bin\config.xml" sc query "%SERVBINARCH%" | Find "RUNNING" If "%ERRORLEVEL%" EQU "1" ( GOTO startsysmon ) :installsysmon xcopy %GLBSYSMONBIN% %SYSMONDIR% /y xcopy %GLBSYSMONCONFIG% %SYSMONDIR% /y chdir %SYSMONDIR% %SYSMONBIN% -i %SYSMONCONFIG% -accepteula -h md5,sha256 -n -l sc config %SERVBINARCH% start= auto :updateconfig xcopy %GLBSYSMONCONFIG% %SYSMONCONFIG% /y chdir %SYSMONDIR% %SYSMONBIN% -c %SYSMONCONFIG% EXIT /B 0 :startsysmon sc start %SERVBINARCH% If "%ERRORLEVEL%" EQU "1060" ( GOTO installsysmon ) ELSE ( GOTO updateconfig )

nick_currie · ‎05-11-2022

Thank you very much for all your help Rick! Unfortunately the original host is a syslog server that has a few different input files - however the file that holds all the forti events is a single input as it's aggregated byour Fortianalyzer device. Plan B i think will have to be a fairly lengthy regexp that has both the policy ID and deviceid. Our Heavy Forwarders have resonable processing power however they are already sitting around 50% util - hopefully this extra pattern matching will not create too much of an overhead.

nick_currie · ‎05-11-2022

Sorry bear with me here - i have inherited this environment and am a splunk n00b - So it looks like we have the Splunk_TA_fortinet_fortigate app installed and this generates the hostname from the devname based on the transforms.conf file in that app as shown below: does this mean i cannot filter on HF's based on the host value? ##sourcetype [force_sourcetype_fgt] SOURCE_KEY = _raw DEST_KEY = MetaData:Sourcetype REGEX = ^.+?devid=\"?F(?:G|W|6K).+?(?:\s|\,|\,\s)type=\"?(traffic|utm|event|anomaly) FORMAT = sourcetype::fgt_$1 [fgt_change_hostname] SOURCE_KEY = _raw DEST_KEY = MetaData:Host REGEX = ^.+?devname=\"(\S+)\"\s FORMAT = host::$1 ## LOOKUP [ftnt_protocol_lookup] filename = ftnt_protocol_info.csv [ftnt_action_lookup] filename = ftnt_action_info.csv [ftnt_event_action_lookup] filename = ftnt_event_action_info.csv ## REPORT [field_extract] DELIMS = "\ ,", "="

nick_currie · ‎05-11-2022

Aha - OK this might be where I am going wrong. The host is right - but I cant see the host field within the event log entry when i look at the source.. Is this why its not triggering? do I need to use devname field devname="FWCL01"? These logs are sent from a Fortianalyzer to a syslog - so perhaps the Host value is generated in a different part of the process

nick_currie · ‎05-11-2022

Hi there - I am trying to filter out some noisy rules in a specific firewall (FWCL01) from being ingested into splunk. On my Heavy forwearder that send into splunk i have applied the following props.conf and transform.conf PROPS.CONF [host::FWCL01] TRANSFORMS-set_null = FWCL01_ruleid0_to_null, FWCL01_ruleid4_to_null TRANSFORMS.CONF [FWCL01_ruleid0_to_null] REGEX = policyid=0 DEST_KEY = queue FORMAT = nullQueue [FWCL01_ruleid4_to_null] REGEX = policyid=4 DEST_KEY = queue FORMAT = nullQueue This doesnt seem to work. However when i change props.conf to us the sourcetype [fgt-traffic] as per below it works [fgt_traffic] TRANSFORMS-set_null = FWCL01_ruleid0_to_null, FWCL01_ruleid4_to_null The logs show as following: May 11 16:12:54 10.8.11.1 logver=602101263 timestamp=1652256773 devname="FWCL01" devid="XXXXXXX" vd="Outer-DMZ" date=2022-05-11 time=16:12:53 logid="0000000013" type="traffic" subtype="forward" level="notice" eventtime=1652256774280610010 tz="+0800" srcip=45.143.203.10 srcport=8080 srcintf="XXXX" srcintfrole="lan" dstip=XXXX dstport=8088 dstintf="XXXX" dstintfrole="undefined" srcinetsvc="Malicious-Malicious.Server" sessionid=2932531463 proto=6 action="deny" policyid=4 policytype="policy" poluuid="XXXXX" service="tcp/8088" dstcountry="Australia" srccountry="Netherlands" trandisp="noop" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 appcat="unscanned" crscore=30 craction=131072 crlevel="high" mastersrcmac="XXXXX" srcmac="XXXXX" srcserver=0 When i use btool it looks like the correct props are being applied D:\Program Files\Splunk\bin>splunk btool props list | findstr FWCL01 [host::FWCL01] TRANSFORMS-set_null = FWCL01_ruleid0_to_null, FWCL01_ruleid4_to_null Any idea's?

Posts	13
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎03-24-2022

Online Status	Offline
Date Last Visited	‎08-15-2024 12:25 PM

Splunk Stream App and Developer License

Blacklisting in [WinEventLog://Security]

Splunk UF not executing script - Sharing Violation

How to filter Specific Data from a host?

Re: Splunk Stream App and Developer License

Splunk Stream App and Developer License

Re: Blacklisting in [WinEventLog://Security]

Re: Blacklisting in [WinEventLog://Security]

Re: Blacklisting in [WinEventLog://Security]

Re: Blacklisting in [WinEventLog://Security]

Blacklisting in [WinEventLog://Security]

Splunk UF not executing script - Sharing Violation

Re: Filtering Specific Data from a host

Re: Filtering Specific Data from a host

Re: Filtering Specific Data from a host

How to filter Specific Data from a host?

Are you a member of the Splunk Community?