Good Afternoon,     I am having an issue with the ThreatConnect TA. The API appears to be connecting as expected but no logs are in the index. I observed within splunkd.log the log sample found below. Looking at the props.conf, it appears it is configured correctly. has anyone had this issue? it appears the logs are in epoch time. 12-15-2021 20:36:44.013 +0000 WARN DateParserVerbose [38565 merging_1] - The TIME_FORMAT specified is matching timestamps (INVALID_TIME (1639600603907184)) outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=tc_download_indicators.py|host=127.0.0.1|threatconnect-app-logs|10128188 PROPS.CONF config [threatconnect-app-logs] INDEXED_EXTRACTIONS = json NO_BINARY_CHECK = true TIMESTAMP_FIELDS = timestamp TIME_FORMAT = %s.%6N category = Application description = ThreatConnect App Logs pulldown_type = 1 [threatconnect-event-data] INDEXED_EXTRACTIONS = json NO_BINARY_CHECK = true TIMESTAMP_FIELDS = timestamp TIME_FORMAT = %s.%6N category = Application description = ThreatConnect Matched Event Data pulldown_type = 1 [source::...tc_ar_send_to_playbook.log*] sourcetype = send_event_to_threatconnect_playbook:*     ... View more

I am utilizing the Graph API TA in order to pull in logs but I need to utilize a second installment of the same app on the same HF in order to pull in federal logs.  This is due to the fact that the original app is pointing to .com addresses and need to be pointed to .us addresses.  when I install the "copied app" it will not load or display the config screen. Does anyone know what needs to be changed within the app to make this possible? I tried just renaming the folder so that it would be a "Graph app_B" but the TA will not load after making this change. Is there any other .conf file that requires adjustment? Please be as specific as possible. Thanks!! ... View more

I am working on upgrading a deployment server which is typically an easy task. My issue is that this particular environment has a strange path instead of the usual /opt/splunk/etc. This environment has /opt/Splunk/splunkenterprise/etc/. I feel like if i run the upgrade as i normally do untarring the file to /opt, it could create some issues. does anyone have insight as to if this should be upgraded "business as usual" or if the command needs modification? I am worried that untarring in under /opt will cause issues with other possible dependencies to particular file paths.  ... View more

We recently upgraded a splunk environment to version 8.0.2 from a 7.2 version. Along with this, we upgraded Splunk Enterprise Security to version 6.4.1. Once the upgrade was completed, splunk shows a critical error related to delayed searches that was not an issue before. I did notice that there are quite a few data models accelerated and suspect this could be the cause. Has anyone had an issue with Splunk having delayed searches post upgrade or possibly data models being automatically accelerated post upgrade? This was not an issue prior so I feel it is most likely related to the ES or Splunk upgrade itself. ... View more

I am experiencing an issue where the rules in place are firing as expected but have suddenly the past 2 weeks stopped sending email alerts. while this wouldnt be difficult to troubleshoot if it was ALL alerts, its only a select few. The configuration of the email alerts are the same as the alerts that are working and emailing as expected. Has anyone experienced this issue before? ... View more

When searching for sourcetype=recorded future IOCS, i receive the following error. I updated the API key and that fixed the issue of not being able to authenticate but now I am receiving this error. Is there somewhere within the config i need to stop the script from being started via Command line? No session key was provided by the Splunk server. This can happen if the script is started from the command line which is not supported. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-recorded_future/bin/get-rf-threatlists.py", line 186, in main session_key = rf_splunk.api_key.get_session_key() File "/opt/splunk/etc/apps/TA-recorded_future/bin/rf_splunk/api_key.py", line 85, in get_session_key raise MissingSessionKeyError('No session key was provided by the ' MissingSessionKeyError: No session key was provided by the Splunk server. This can happen if the script is started from the command line which is not supported. ... View more