Wanted to share my experience with this app after troubleshooting it with Mr bradp123 (thank you btw!)
*Everything i'm writing was done on Splunk 6.2*
First, the python script needed to be adjusted for me. For some reason it was passing 4 arguments when i was only giving it three (username, password, url). In order to fix this i changed the main portion to look like this: `
if __name__ == '__main__':
if True:
username=sys.argv[1]
password=sys.argv[2]
url=sys.argv[3]
sc = sc_connect(username, password, url)
sc.vulnipdetail()
else:
print "Usage $SPLUNK_HOME/bin/splunk cmd python %s \"username\" \"password\" \"url\"" % sys.argv[0]
print "\n\n"
print "Where:-"
print " username is a valid Security Center Username"
print " password is the password for the Security Center Username"
print " url is a valid Security Center request URL, example:- https://192.168.1.2/request.php";
print "\n\n"
print "Running this script directly is for testing purposes only."
print str(len(sys.argv))
Second, i needed to add the proper sourcetype to the props.conf file and changed the regex for the LINE_BREAKER. Here is what this looks like for me:
[security_center_vulndetails]
BREAK_ONLY_BEFORE=(pluginID)
KV_MODE=json
#LINE_BREAKER=(,|\[)\{
LINE_BREAKER=\}(,)\{
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TRUNCATE=1000000
... View more
