About TheLawsOfChaos

TheLawsOfChaos · ‎08-10-2024

I'm not normally one to resurrect dead posts, but as I was myself trying to accomplish the same task and via Google found this post, figured I'd give an update. Per the documentation for the TA (https://docs.splunk.com/Documentation/AddOns/released/CiscoASA/Releasehistory) they removed the eventgen support in version 3.2.5

TheLawsOfChaos · ‎07-18-2024

Can you please list which vulnerability scanner was used to determine this finding, and which pluginid? This information is used to see some information that is vital for us to really triage this : 1) See what the vulnerability scanner is actually looking for 2) See if Splunk is actually affected, as there are many times I'm guessing this is from Qualys, and is QID 38599. I know this plugin is old, as it's mentioned in a community post on Qualys' website from 2014, and is related to the 'CRIME' attack. If I am correct on this being the plugin in question, its about CVE-2012-4929. There is an official Splunk response about this CVE here : https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-shows-vulnerable-to-CVE-2012-4929-in-my-Nessus/m-p/29092/highlight/true#M69597 Important parts from what the Splunk employee stated are : This is directed at web browsers hitting web servers, which are not any of the ports you listed. Splunk doesn't use SPDY at all This bug is more about web browsers hitting servers, and as such Splunk web won't mitigate against vulnerable browsers. That said, again, this is from 2012 and it's 2024 so it's unlikely anyone is using an affected browser and even if they were, 8089/8191/8088 are not web server ports. I would write up documentation stating that this plugin should be ignored for this use case, as this vulnerability is no longer relevant on modern technology.

TheLawsOfChaos · ‎07-18-2024

So when running the Splunk service, you do not want to be running it as root (which is primarily what sudo does). Since you have run some of the commands via sudo, that means some of the file permissions most likely were changed to root owning it. You would want to follow these steps: First, you need to ensure that the splunk user/group owns the files, since you have been running it as root (sudo) 1) sudo chown -R splunk:splunk /opt/splunk Second, you want to become the splunk user 2) sudo su splunk Then you want to run your commands as normal 3) ./splunk enable boot-start -user splunk or ./splunk enable boot-start -user splunk -systemd-managed 1 if you are using systems on your system. By running the commands as the splunk user, you ensure that the splunk user maintains ownership over /opt/splunk, and that means that the enable boot start will be able to work. I think if you checked your linux logs, you would see during boot up there are probably permission errors stating that the user splunk does not have access to the /opt/splunk folder, due to the sudo issues. After doing this, while still as the splunk user you can run ./splunk start. If you don't want to do sudo su splunk, to become the user you can use something like this instead: sudo -H -u splunk $SPLUNK_HOME/bin/splunk start This will let you use sudo as your user, tell it to act as the splunk user, and then start splunk. This method of sudo usage could replace directly sudo su splunk if needed.

TheLawsOfChaos · ‎07-17-2024

So there are a lot of questions to ask, as you state just linux. Is it debian or centos/redhat based? If it's redhat, are you using systemd? https://docs.splunk.com/Documentation/Splunk/9.2.2/Admin/ConfigureSplunktostartatboottime When you run [sudo] $SPLUNK_HOME/bin/splunk enable boot-start -user splunk what sort of output do you get? Keep in mind if you are using systemd there is an entire section in the documentation that goes over fighting that lovely beast. Have you checked /opt/splunk/var/log/splunk/splunkd.log to see if there are any issues with it attempting to autostart? Sometimes things such as permissions issues can also affect it. Are you able to manually start splunk as the splunk user and it boots up fine?

TheLawsOfChaos · ‎04-07-2024

To lock a single dashboard down, you would want to create a new custom user that does not inherit the user permission. Then you would grant that user read permissions to that single dashboard. Then the user can get to it via the link, but not even going to the app to browse for it. If they can view ES, they can view all the dashboards (by default). You could go dashboard by dashboard, and change the custom nav to reflect it. But if you want the user to only see that one part of ES, I'd recommend the method I laid out up top.

TheLawsOfChaos · ‎04-07-2024

I know it's a little bit delayed, but due to the nature of the 0day from February you would need to know which method was being exploited (i.e. which characters the exact attack wanted to utilize). That said, you could write a detection that checks for Outlook.exe (and all versions of it) connecting over port 445. If you have sysmon installed, you could use EventId 3's for this. Florian Roth also wrote a YARA rule that could detect emails that have that malicious Moniker link in it : rule EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24 { meta: description = "Detects emails that contain signs of a method to exploit CVE-2024-21413 in Microsoft Outlook" author = "X__Junior, Florian Roth" reference = "https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability/" date = "2024-02-17" modified = "2024-02-19" score = 75 strings: $a1 = "Subject: " $a2 = "Received: " $xr1 = /file:///\\[^"']{6,600}.(docx|txt|pdf|xlsx|pptx|odt|etc|jpg|png|gif|bmp|tiff|svg|mp4|avi|mov|wmv|flv|mkv|mp3|wav|aac|flac|ogg|wma|exe|msi|bat|cmd|ps1|zip|rar|7z|targz|iso|dll|sys|ini|cfg|reg|html|css|java|py|c|cpp|db|sql|mdb|accdb|sqlite|eml|pst|ost|mbox|htm|php|asp|jsp|xml|ttf|otf|woff|woff2|rtf|chm|hta|js|lnk|vbe|vbs|wsf|xls|xlsm|xltm|xlt|doc|docm|dot|dotm)!/ condition: filesize < 1000KB and all of ($a*) and 1 of ($xr*) } I hope that this late in the game, you have patched all your Outlook installations, and would instead go for detecting if any are unpatched.

TheLawsOfChaos · ‎04-07-2024

If you mean rendering it that way on the Incident Review page, that is because that part of the page isn't expecting HTML, only raw data. To achieve this, you would need to use custom .js, along with a clone of the incident review page (if you are on an on-prem instance, and you cannot if you are on cloud I believe) to basically remap those fields for all notables.

TheLawsOfChaos · ‎11-02-2023

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/Alert/AlertTriggerConditions Per the documentation, you can't control the ability to trigger via permissions.

TheLawsOfChaos · ‎02-01-2022

They are trying to combine one csv/lookup with the values of a second lookup. If you were going to go the lookup route you would do the generating search, then run the lookup against the 'correct' priority data, to return the correct priority as something like 'new_priority', and then coalesce on that.

TheLawsOfChaos · ‎02-01-2022

TheLawsOfChaos · ‎06-26-2017

So first I have a hidden dropdown that does the query for me : <label>field1</label> <selectFirstChoice>true</selectFirstChoice> <search> <query>| inputlookup "$hits_csv$" | fields epochtime</query> <earliest>0</earliest> <latest>now</latest> </search> <fieldForValue>epochtime</fieldForValue> </input> Since it's hidden, users will never see it. And for my search base, I utilize: <earliest>$earlytime$</earliest> <latest>now</latest> So my normal timepicker defaults to -7d@h, so before I enter any csv names in, it defaults to 7 days ago, but once you enter in a csv and hit enter, it completes all the searches based upon the epoch time in the csv. When I generate the csv, I'm actually generating a human readable format and the epoch time (wasn't sure initially which Splunk preferred) so luckily I don't have to translate anything. All in all, I'm using the hidden dropdown as a variable. <selectFirstChoice>true</selectFirstChoice> That makes it possible, in that it will always pick the first choice, and I only compute the time once in the csv, so easy peasy!

TheLawsOfChaos · ‎06-23-2017

Sadly I left work a few hours ago (I'm in CET timezone) so I haven't tried your's yet. I'll try it on Monday, as well as share my code then when I have access to my system at work.

TheLawsOfChaos · ‎06-23-2017

Thanks Woodcock, ironically enough, I thought of a new idea and solved it roughly an hour after I posted this request. I ended up working with a hidden dropdown, that runs the search query similar to yours, and then use that token for the default time. Also made the hidden dropdown be dependent on the CSV field. I can post the code when I get back to work Monday, if we want to keep it for posterity's sake of other people searching for this.

TheLawsOfChaos · ‎06-23-2017

Hello everyone! Some background first : Dashboard with many panels. Have a base search set up, and then using that for other searches on the dashboard. I have a text input field called "source_url" and a text input field called "hits_csv". When the user of the dashboard enters in the source url, and a csv (with fields user, md5, url, epochtime, time) it then searches for all the panels. I'm trying to automate some of the manual entry. I already have the dashboard reading in the 'url' field for the searches in the base search, by utilizing "[|inputlookup "$hits_csv$" | rename url as search]" in my search macro. Works amazing. But now I'm trying to change the time picker's default earliest time to : |inputlookup "$hits_csv$" | fields time (I was initially using epoch time, but saw the format needed for timepicker, so changed it to the proper format) Only I don't see a way to give a search query to earliest (states Value node is not supposed to have children). I have also attempted to utilize change with the condition of * for the timepicker: <condition label="*"> <set token="form.timepicker.earliest">([|inputlookup "$hits_csv$" | fields time])</set> <set token="form.timepicker.latest">relative_time([|inputlookup "$hits_csv$" | fields time]",+2d")</set> </condition> </change> I've also tried to use eval instead of set. If this was C or bash or python, I would declare a variable and assign it the result of my query, and then pass it along later. No idea how to do this here within this frame. Also for added info, the query "|inputlookup "$hits_csv$" | fields time" will return "06/23/2017:12:48:17", so it should be the proper format for timepicker. If this is unclear please let me know. I've tried to do research all over these forums, and I'm just not sure if I'm the first person to try this, or something is glaringly obviously wrong here. I'm currently running Splunk 6.5.3.

Posts	14
Solutions	2
Karma Given	5
Karma Received	2
Member Since	‎06-23-2017

Online Status	Offline
Date Last Visited	3 weeks ago

How to dynamically generate time picker data from ...

Re: generate dummy data -eventgen

Re: Vulnerability in compression algorithm

Re: Splunkd services are not starting on boot-star...

Re: Splunkd services are not starting on boot-star...

Re: Read Only Executive Summary Splunk ES

Re: Use Case

Re: I'd like to format the Notable Event Descripti...

Re: How to schedule a report (not an alert) to s...

Re: Lookup help: Replace column result with value ...

Re: Lookup help: Replace column result with value ...

Re: How to dynamically generate time picker data f...

Re: How to dynamically generate time picker data f...

Re: How to dynamically generate time picker data f...

How to dynamically generate time picker data from ...

Are you a member of the Splunk Community?