About sidnakvee

sidnakvee · ‎11-10-2024

Hi ! thanks for your reply yeah I tied with phantom account as well still see error for folder permission ro soar-phantom . Not sure what mistake I am doing . Is there any detaied video link or documntation to follow ? thanks

sidnakvee · ‎11-09-2024

Sorry forgot to mention its version 6.3.0

sidnakvee · ‎11-09-2024

Hi ! I am stuck for my home lab trying to install phantom on VM . All steps for soar-prep competed fine but then I tried ./soar-install seeing errors like : Error: Cannot run as the root user Error: The install directory (/opt/phantom) is not owned by the installation owner (root) Pre-deploy checks failed with errors Directory has root access with all folders in it image attched . {"component": "installation_log", "time": "2024-11-10T02:02:56.071875", "logger": "install.deployments.deployment", "pid": 2005, "level": "ERROR", "file": "/opt/phantom/splunk-soar/install/deployments/deployment.py", "line": 175, "message": "Error: The install directory (/opt/phantom) is not owned by the installation owner (root)", "install_run_uuid": "17e0674c-b035-4696-9f75-acf2297ab325", "start_time": "2024-11-10T02:02:54.547287", "install_mode": "install", "installed_version": null, "proposed_version": "6.3.0.719", "deployment_type": "unpriv", "continue_from": null, "phase": "pre-deploy", "operation_status": "failed", "time_elapsed_since_start": 1.524704} {"component": "installation_log", "time": "2024-11-10T02:02:56.072144", "logger": "install", "pid": 2005, "level": "ERROR", "file": "/opt/phantom/splunk-soar/./soar-install", "line": 105, "message": "Pre-deploy checks failed with errors", "install_run_uuid": "17e0674c-b035-4696-9f75-acf2297ab325", "start_time": "2024-11-10T02:02:54.547287", "install_mode": "install", "installed_version": null, "proposed_version": "6.3.0.719", "deployment_type": "unpriv", "continue_from": null, "time_elapsed_since_start": 1.525168, "pretty_exc_info": ["Traceback (most recent call last):", " File \"/opt/phantom/splunk-soar/./soar-install\", line 82, in main", " deployment.run()", " File \"/opt/phantom/splunk-soar/install/deployments/deployment.py\", line 145, in run", " self.run_pre_deploy()", " File \"/opt/phantom/splunk-soar/usr/python39/lib/python3.9/contextlib.py\", line 79, in inner", " return func(*args, **kwds)", " File \"/opt/phantom/splunk-soar/install/deployments/deployment.py\", line 178, in run_pre_deploy", " raise DeploymentChecksFailed(", "install.install_common.DeploymentChecksFailed: Pre-deploy checks failed with errors"]}

sidnakvee · ‎08-17-2024

Hi ! I am facing the same issue getting windows logs and sysmon logs but not getting any Linux and zeek logs . Using this inputs.conf file and all settings followed per documentation credneial package installed sucessfully as well. Also installed Zeek Apps as well. Sorry forgot to mention that seeing hosts when do index=_internal search last 24 hours. Any help please ? default] host = zeek-VirtualBox [monitor:///var/log/messages] disabled = 0 index = unix [monitor:///var/log/syslog] disabled = 0 index = unix [monitor:///var/log/faillog] disabled = 0 index = unix [monitor:///var/log/auth.log] disabled = 0 index = unix [monitor:///opt/zeek/log/current] disabled = 0 _TCP_ROUTING = * index = zeek sourcetype = bro:jason whitelist = \.log$

sidnakvee · ‎08-13-2024

Hi, Finally figured it out as cloud neded UF crednetial to be installed . So did that and no I see my logs . Thanks everyone for your support .

sidnakvee · ‎08-12-2024

Hi @gcusello thanks for you reply and help . Yes i did the followings: 1- Installed sysmon on my PC 2- Installed Splunk forwarder on my PC 3- Configured the inputs.conf by copying to 4- Alread created index=winpc index on splunk 5- Dont see my PC / hostname from index=_internal logs last 30 days only see splunk hostname 6- Do I need to install universal forwarder credentail packge i tried but its fails when try to run the given comand here on : https://docs.splunk.com/Documentation/Forwarder/9.1.0/Forwarder/ConfigSCUFCredentials#Install_the_forwarder_credentials_on_individual_forwarders_in_Windows 7- My splunk unversal forwarder was installed to C:\Program Files\SplunkUniversalForwarder and service is running.

sidnakvee · ‎08-11-2024

Hi , I am new to Spunk just got Free Cloud Trial. I did the followings : 1- Logged in to Cloud trial instance 2- Created Index name winpc 3- App > Univeral forwarded and downloaded on Win PC 4- Installed Forwarded on WInPC during step on use this agent with selected use with cloud instance 5- Receiver index left blank had no idea about my splun instance FQDN /IP 6- Checked services Splunk universal forwarded service running as Logon As Local system Issues : 1- No Logs I can see into index winpc created after waiting a hour or so 2- How can I tell forwarded to forward win and sysmon logs too should I edit inputs.conf file ? Kindly guide and help so that I may get logs and learn any further . Regards

Posts	7
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎08-11-2024

Online Status	Offline
Date Last Visited	‎11-10-2024 12:08 AM

I can not install phantom using ./soar-install

Splunk Cloud Not seeing Windows logs

Re: I can not install phantom using ./soar-install

Re: I can not install phantom using ./soar-install

I can not install phantom using ./soar-install

Re: logs are not getting from Linux machine

Re: Splunk Cloud Not seeing Windows logs

Re: Splunk Cloud Not seeing Windows logs

Splunk Cloud Not seeing Windows logs

Are you a member of the Splunk Community?