Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About serwin
serwin
Explorer
Member since:
07-25-2014
06-05-2020
Community Statistics
| Posts | 11 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 6 |
| Member Since | 07-25-2014 |
Activity Feed
- Karma Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors? for Masa. 06-05-2020 12:48 AM
- Got Karma for How to disable the universal forwarder default management port 8089 with a deployment server?. 06-05-2020 12:48 AM
- Got Karma for Re: How to disable the universal forwarder default management port 8089 with a deployment server?. 06-05-2020 12:48 AM
- Got Karma for Re: How to disable the universal forwarder default management port 8089 with a deployment server?. 06-05-2020 12:48 AM
- Got Karma for Re: How to disable the universal forwarder default management port 8089 with a deployment server?. 06-05-2020 12:48 AM
- Got Karma for Re: How to disable the universal forwarder default management port 8089 with a deployment server?. 06-05-2020 12:48 AM
- Got Karma for Re: How to disable the universal forwarder default management port 8089 with a deployment server?. 06-05-2020 12:48 AM
- Posted Using Standard Deviation to track SSH traffic on Splunk Search. 10-24-2017 09:48 AM
- Tagged Using Standard Deviation to track SSH traffic on Splunk Search. 10-24-2017 09:48 AM
- Tagged Using Standard Deviation to track SSH traffic on Splunk Search. 10-24-2017 09:48 AM
- Tagged Using Standard Deviation to track SSH traffic on Splunk Search. 10-24-2017 09:48 AM
- Tagged Using Standard Deviation to track SSH traffic on Splunk Search. 10-24-2017 09:48 AM
- Posted Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors? on Security. 07-29-2016 01:09 PM
- Posted Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors? on Security. 07-29-2016 09:59 AM
- Posted Re: Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors? on Security. 07-29-2016 09:47 AM
- Posted Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors? on Security. 07-29-2016 09:25 AM
- Tagged Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors? on Security. 07-29-2016 09:25 AM
- Tagged Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors? on Security. 07-29-2016 09:25 AM
- Tagged Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors? on Security. 07-29-2016 09:25 AM
- Tagged Splunk Enterprise 8089 Vulnerability Scan Results: How do I resolve these SSL errors? on Security. 07-29-2016 09:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
10-24-2017
09:48 AM
I'm looking for a way to traffic the average ssh traffic between two IP addresses (source IP and destination IP) and hopefully find when a host is doing more SSH traffic than usual and alert on it. I've been looking through some of the standard deviation paperwork and I think I found a search I wanted to do but the standard deviation I get is zero; which doesn't make sense.
Here is what I've been playing around with.
sourcetype="cisco:asa" dest_port=22
| stats count by src_ip, dest_ip
| stats mean(count) as mean, stdev(count) AS stdev by src_ip
| eval stdv_percentage=(mean/stdev)*100
... View more
07-29-2016
01:09 PM
Awesome!
That's what i was looking for!
Quick question, for 1,2,3 do those fixes apply for stuff on the management port (8089)?
Thanks
... View more
07-29-2016
09:59 AM
Generally, yes I should be able to exclude if I need to but... more than likely I'll need a reason why I'm leaving this enabled (yay compliance). Thanks for the suggestion though, that may be what has to happen.
... View more
07-29-2016
09:47 AM
using splunk 6.4.1, you got a link handy and i'll read through that?
Thanks!
... View more
07-29-2016
09:25 AM
Hello,
I'm required to scan my Splunk Enterprise environment for compliance reasons. When I'm scanning my search heads and indexers ,I keep getting multiple SSL errors for the management port 8089. I've searched and haven't found a way figure out a method to upload a third party cert to fix this or if this is something that I'll just have to make not isn't fixable. I've included some of the vulnerability issues I've found. Not sure if opening a ticket with support would get me the information I need.
SSL Version 2 and 3 Protocol Detected
SSL Cert Signed Using Weak Hashing Algorithm (SHA1)
SSL Certificate Wrong Hostname (Splunk Self Signed Cert running on 8089)
TLS CRIME Vulnerability
Thanks!
... View more
07-27-2016
09:49 AM
5 Karma
Actually solved this one myself, when adding the app you don't need to specify directories you just need to place it in deployment-apps/disable_mgmt/local/server.conf and it will work.
... View more
07-27-2016
09:14 AM
1 Karma
I'm trying to disable the default management point on the universal forwarders (8089) with the deployment server and I'm having a hard time getting the deployment server to deploy correctly. I have created the app that should disable it and it successfully pushes, but when I do a netstat, it's still listening. Anyone have any advice or see anything I'm doing incorrectly? If I edit the local\server.conf on the test server, it successfully disables the management port.
Thanks!
On the deployment server
deployment-apps\disable_mgmt_app\etc\system\local\server.conf
[httpServer]
disableDefaultPort = true
... View more
07-10-2015
11:14 AM
I just fixed the same error. My ES Windows deployment, the folder
C:\Program Files\Splunk\etc\apps\SA-ThreatIntelligence\local\data\threat_intel
was set to ready-only. Quick change of the settings and everything is running smoother.
Good luck!
... View more
07-08-2015
01:42 PM
Afef,
If you're running 6.2.3, here is the location of the threatlists. I just found mine and the folder was indeed read only.
C:\Program Files\Splunk\etc\apps\SA-ThreatIntelligence\local\data\threat_intel
... View more
07-07-2015
01:56 PM
SoS App works well.
You can make a search that checks the splunkd.log for stopped, started, etc. See below
index=_internal source=*splunkd.log host=* component=IndexProcessor ("shutting down: end" OR "Initializing: readonly") | eval restart_status=if(message="shutting down: end","Stopping","Starting")
... View more
06-23-2015
07:37 AM
I'm looking to add cold storage to my Splunk 6.2.2 indexer clustering setup and just wanted to verify my process was the best.
I want to change splunk-launch.conf on each of my indexers to added an additional:
SPLUNK_DBC=C:\Path-to-cold-storage
then in my indexer clustering config, just change the cold data storage to:
coldPath = $SPLUNK_DBC\event\event
Is this the best way to do this, or am i missing something? Also, would i leave my thawedPath as my home path?
Thanks
... View more
