Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About splunk_cv
splunk_cv
Explorer
Member since:
04-03-2015
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 04-03-2015 |
Activity Feed
- Got Karma for Splunk App for Salesforce: How to configure multiple accounts for different organizations?. 06-05-2020 12:48 AM
- Posted Splunk App for Salesforce: How to configure multiple accounts for different organizations? on All Apps and Add-ons. 01-23-2017 02:51 AM
- Tagged Splunk App for Salesforce: How to configure multiple accounts for different organizations? on All Apps and Add-ons. 01-23-2017 02:51 AM
- Tagged Splunk App for Salesforce: How to configure multiple accounts for different organizations? on All Apps and Add-ons. 01-23-2017 02:51 AM
- Tagged Splunk App for Salesforce: How to configure multiple accounts for different organizations? on All Apps and Add-ons. 01-23-2017 02:51 AM
- Tagged Splunk App for Salesforce: How to configure multiple accounts for different organizations? on All Apps and Add-ons. 01-23-2017 02:51 AM
- Posted Re: Splunk Add-on for Symantec Endpoint Protection 2.1.1: Malware category lookup table not updating on All Apps and Add-ons. 06-08-2016 06:15 AM
- Posted Re: Splunk Add-on for Symantec Endpoint Protection 2.1.1: Malware category lookup table not updating on All Apps and Add-ons. 06-06-2016 08:08 AM
- Posted Re: My search parses all fields in the Search App, but why do I get null results putting it in a Splunk Enterprise Security correlation search? on Splunk Enterprise Security. 06-03-2016 01:46 PM
- Posted Re: My search parses all fields in the Search App, but why do I get null results putting it in a Splunk Enterprise Security correlation search? on Splunk Enterprise Security. 06-03-2016 01:40 AM
- Posted Re: My search parses all fields in the Search App, but why do I get null results putting it in a Splunk Enterprise Security correlation search? on Splunk Enterprise Security. 06-01-2016 08:42 AM
- Posted My search parses all fields in the Search App, but why do I get null results putting it in a Splunk Enterprise Security correlation search? on Splunk Enterprise Security. 06-01-2016 07:36 AM
- Tagged My search parses all fields in the Search App, but why do I get null results putting it in a Splunk Enterprise Security correlation search? on Splunk Enterprise Security. 06-01-2016 07:36 AM
- Tagged My search parses all fields in the Search App, but why do I get null results putting it in a Splunk Enterprise Security correlation search? on Splunk Enterprise Security. 06-01-2016 07:36 AM
- Tagged My search parses all fields in the Search App, but why do I get null results putting it in a Splunk Enterprise Security correlation search? on Splunk Enterprise Security. 06-01-2016 07:36 AM
- Tagged My search parses all fields in the Search App, but why do I get null results putting it in a Splunk Enterprise Security correlation search? on Splunk Enterprise Security. 06-01-2016 07:36 AM
- Tagged My search parses all fields in the Search App, but why do I get null results putting it in a Splunk Enterprise Security correlation search? on Splunk Enterprise Security. 06-01-2016 07:36 AM
- Posted Re: Splunk Add-on for Symantec Endpoint Protection 2.1.1: Malware category lookup table not updating on All Apps and Add-ons. 05-26-2016 07:50 AM
- Posted Re: Why is one of my universal forwarders trying to contact the deployment server on port 9997? on Getting Data In. 05-08-2016 08:53 AM
- Posted Re: Why is one of my universal forwarders trying to contact the deployment server on port 9997? on Getting Data In. 05-03-2016 05:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
01-23-2017
02:51 AM
1 Karma
Hi, i have to collect logs from multiple org with different accounts in my Splunk Enterprise Infrastructure. Is there a way to configure the Splunk App for Salesforce with multiple accounts/org, or do i have to install different apps (one for every org)?
Thank you
Matteo
... View more
06-08-2016
06:15 AM
No, nothing has to be updated. If you're practice with Python, you can check the script "malware_category_update.py" in "\Splunk_TA_symantec-ep\bin" to understand how the app woks about the malware table update.
In particular, if you have a single SH and not a cluster, i supposed you made a mistake during the configuration of the update. In fact, looking at the scriptl you should see the line "This is a single instance or cluster captain. Run the malare_category_update." (line 88) while your log talks about a SH cluster, just like the script thinks that you have a SH cluser configuration. Because you are not in a cluster config, the script can't find the "cluster captain" and skips the update (line 176).
I think you have to check your setup following the documentation here: http://docs.splunk.com/Documentation/AddOns/latest/SymantecEP/Setup
It's a very simple configuration.
Matteo
... View more
06-06-2016
08:08 AM
Hi,
the assumption i made was right. Now the pages http://www.symantec.com/xml/rss/azlistings.jsp?azid= are full of information.
I can confirm that the lookupt table is now correctly updated.
... View more
06-03-2016
01:46 PM
It was a problem about the name of the custom app. I renamed it as TA- instead of HA- and now it works correctly. Many thanks.
... View more
06-03-2016
01:40 AM
Yes, there is an app made for the fields extraction installed on the SH and the permissions are for all apps. If you want i could show you the .conf files that you need to check.
The strange think is that in the other apps the fields are extracted, but not in the Enterprise Security app.
... View more
06-01-2016
08:42 AM
Additional info: i think the problem is that in the "Search & Reporting" App all fields are extracted correctly, but in Enterprise Security the log are not parsed. So i suppose that the correlation search can't find the fields like I described in my question.
Any idea about the reason of this behavior?
Thanks
... View more
06-01-2016
07:36 AM
Hi all,
I wrote this search that shows me when certain SSIDs are matched.
sourcetype=rogap SSID="*skynet*" OR SSID="*skymobile*" OR SSID="*skyguest*" | table src AP_name MAC SSID channelNumber location
All the fields in the search are correctly parsed in verbose mode. The search shows the correct results both in fast and verbose mode, but when I put it in a correlation search in Splunk Enterprise Security I have no results.
I modified the search to find the error. If I put this search:
sourcetype=rogap skynet | fields src AP_name MAC SSID channelNumber location | fillnull value=null | table src AP_name MAC SSID channelNumber location
I have a result, but all the fields are null .
src AP_name MAC SSID channelNumber location
null null null null null null
So I think the problem is that in the correlation search, Splunk can't check the SSID value and so it doesn't return any results.
How can I solve this problem?
I already tried to use |fields ....| with no results
Thanks
... View more
05-26-2016
07:50 AM
Hi,
i have the same issue. I tryed to debug the http connections with tcpdump and with Splunk logs in index=_internal source="*ta_symantec-ep.log
My thoughts is that the page where the app is looking for the updates has been dismissed. Look at these logs:
2016-05-26 16:20:26,149 INFO pid=40591 tid=MainThread file=malware_category_update.py:run:170 | The SPL is executed correctly.
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,833 INFO pid=40591 tid=MainThread file=malware_category_update.py:run:164 | Start the SPL
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,833 INFO pid=40591 tid=MainThread file=malware_category_update.py:run:162 | Start the SPL
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,671 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=_1234567890
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,645 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=Z
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,614 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=Y
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,587 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=X
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,553 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=W
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,528 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=V
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,502 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=U
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,474 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=T
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,449 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=S
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,425 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=R
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,399 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=Q
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,374 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=P
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,349 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=O
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,322 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=N
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,299 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=M
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,276 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=L
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,247 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=K
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,219 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=J
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,192 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=I
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,169 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=H
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,144 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=G
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,117 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=F
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,094 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=E
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,068 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=D
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,045 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=C
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:25,022 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=B
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:24,975 INFO pid=40591 tid=MainThread file=malware_category_update.py:extract_xml:36 | Requesting url:http://www.symantec.com/xml/rss/azlistings.jsp?azid=A
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:24,874 INFO pid=40591 tid=MainThread file=malware_category_update.py:run:88 | This is a single instance or cluster captain. Run the malare_category_update.
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:24,853 INFO pid=40591 tid=MainThread file=malware_category_update.py:run:84 | End reading session key
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:24,853 INFO pid=40591 tid=MainThread file=malware_category_update.py:run:80 | Start reading session key
host = splnkshmi-prd04.sky.local source = /splunkdata/splunk/var/log/splunk/ta_symantec-ep.log sourcetype = ta_symantec-ep
2016-05-26 16:20:24,852 INFO pid=40591 tid=MainThread file=malware_category_update.py:run:79 | Script input start.
You can see that the script start to contact different urls (from A to Z and one last link) and all the steps are mode properly. But f you try to contact those links you'll obtain a page with this phrase: http://www.symantec.com/business/landing/azlisting.jsp The Threat Explorer is a comprehensive resource for daily, accurate and up-to-date information on the latest threats, risks and vulnerabilities. en-us
Maybe Symantec moved the tables. I hope someone will answer or update the app.
... View more
05-08-2016
08:53 AM
Thanks for the answer. I found the problem on my own some days ago, analyzing the btool's output: the FW installation was made from a third person, and he indicates the DS also as an IX during the installation process, so of course the FW tryed to send data the DS instead of the IXs.
... View more
05-03-2016
05:26 AM
Today i tried to unistall the Universal Forwarder on the remote host, and i noticed that after it was uninstalled (or during the uninstallation operations, i can't say it exactly) I receveid all the internal log that i haven't received previously. Someone can explain this strange behavior?
... View more
04-28-2016
12:27 AM
@schose here is the ouptut:
Note: The OA-output_forwarder is an app deployed on every forwarder with the outputs.conf file configured to send data to our 6 indexers.
UF\etc\system\default\outputs.conf type = udp
UF\etc\apps\SplunkUniversalForwarder\default\outputs.conf [tcpout]
UF\etc\system\default\outputs.conf ackTimeoutOnShutdown = 30
UF\etc\system\default\outputs.conf blockOnCloning = true
UF\etc\system\default\outputs.conf compressed = false
UF\etc\system\default\outputs.conf connectionTimeout = 20
UF\etc\system\default\outputs.conf forceTimebasedAutoLB = false
UF\etc\apps\SplunkUniversalForwarder\default\outputs.conf forwardedindex.0.whitelist = .*
UF\etc\apps\SplunkUniversalForwarder\default\outputs.conf forwardedindex.1.blacklist = _.*
UF\etc\apps\SplunkUniversalForwarder\default\outputs.conf forwardedindex.2.whitelist = (_audit|_introspection)
UF\etc\apps\SplunkUniversalForwarder\default\outputs.conf forwardedindex.filter.disable = false
UF\etc\system\default\outputs.conf indexAndForward = false
UF\etc\system\default\outputs.conf maxConnectionsPerIndexer = 2
UF\etc\system\default\outputs.conf maxFailuresPerInterval = 2
UF\etc\system\default\outputs.conf readTimeout = 300
UF\etc\system\default\outputs.conf secsInFailureInterval = 1
UF\etc\system\default\outputs.conf sslQuietShutdown = false
UF\etc\system\default\outputs.conf useACK = false
UF\etc\system\local\outputs.conf [tcpout-server://10.73.21.105:9997]
UF\etc\system\local\outputs.conf server = 10.73.21.105:9997
UF\etc\apps\OA-output_forwarder\default\outputs.conf [tcpout:indexmi_9997]
UF\etc\apps\OA-output_forwarder\default\outputs.conf server = 10.73.21.103:9997,10.73.21.104:9997,10.73.21.157:9997,
10.73.21.158:9997,10.73.21.159:9997,10.73.21.160:9997
(I reformatted the btool output for readability -@lguinn)
... View more
04-27-2016
11:19 AM
Yes i delivered it via DS, i created an app with inputs.conf in it.
@schose this is a Windows UF, could you provide me instruction for the command under Windows systems?
... View more
04-27-2016
09:14 AM
Hi,
I have a configuration where many Universal Forwarders are managed by a Deployment Server.
Today I installed a new UF on a Windows machine, and I have several problems:
in the internal log I see WARN TcpOutputFd - Connect to :9997 failed. No connection could be made because the target machine actively refused it and ERROR TcpOutputFd - Connection to host=:9997 failed -> Why is the UF trying to contact the DS on 9997?
in the internal log, I can't see the phonehome logs, but looking at the ASA logs, I can see the communication between UF and DS on port 8089 every minute and so I suppose this is the phonehome
Main problem: I have configured the inputs.conf to monitor a path, but I can't see the logs, maybe because the errors above.
[monitor://C:\path\ue_*.log]
index=ftp
sourcetype=ftp
In the outputs.conf I have listed, as usual, my 6 indexers on port 9997.
... View more
06-12-2015
07:06 AM
Good morning,
i have a working installation of the app on a Splunk distribuited environment, but i have this problem:
according to Cisco's guide i have to check "Discovery Events" to transmit host discovery events. So i checked "Discovery Events" in System->Local->Registration.
I can see events in VDC in the tab Analysis->Host->Discovery Events, but i can't find the log for those events in Splunk.
Are there other configurations or other things to check? Or maybe i have a wrong idea about Discovery Event?
Thank in advance
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
