Nope, not yet. The add-on is still on v2 in SplunkBase, not changed since 2017. ... View more

Is that being indexed from a UF version 6.2.0 or later? That is a prerequisite. Additionally, do you have Splunk_TA_windows installed on that device as well? I believe that is what creates the XmlWinEventLog intake tooling. ... View more

It looks like the start_from and current_only stanzas dont appear anymore in the inputs.conf definition. Maybe it is no longer supported? ... View more

This works for me: [WinEventLog://Microsoft-Windows-Windows Defender/Operational] index = windefender disabled = false renderXml = 1 I confirm logs coming into Splunk for index=windefender with that input. Confirm that your Windows Defender log location is correct for your system. ... View more

Said this above, but look at https://github.com/pdoconnell/TA-microsoft-windefender for now. When this ends up on SplunkBase, I'll link there. ... View more

Yup, this looks like me. I'm currently getting my TA certified, but if you want to look into it @5splunked, you can at https://github.com/pdoconnell/TA-microsoft-windefender ... View more

When this is released, can the documentation please include the specific ELFF string to be used in bluecoat as well. ... View more

to build in @lguinn's answer above, you need to add "index=" to the beginning of the following objects: r7vulnexceptiondata r7vulnerabilitydata r7assetdata They can all be found under the rapid7 app's Event Types, found at https://YOUR_HOST_NAME:8000/en-US/manager/search/saved/eventtypes ... View more

I haven't been able to find any reference to either sourcetypes or indexes in the dashboard configs. If anyone can see them, that would be enough I believe. ... View more

Actually, after recopying your suggestion into the search, it appears to be working correctly. Its possible that I somehow botched the search syntax the first time. For the record, this is the search that is working now: index=wineventlog sourcetype=WinEventLog:Security EventCode=560 OR EventCode=4663 OR EventCode=5145 NOT user=*$ | lookup lookup_wild_folder folder_lookup AS folder_name, server AS host OUTPUT group_lookup user_lookup file_exceptions | eval user=if(isnull(Object_Name),null,user) | eval user=if(match(Object_Name,folder_lookup),null,user) | eval user=if(match(user_lookup,user),null,user) | eval user=if(match(Object_Name,file_exceptions),null,user) | table user host folder_lookup folder_name Object_Name Message group_lookup | ldapfilter domain=default search="(sAMAccountName=$user$)" attrs="memberOf" | rex field=memberOf "^CN=(?[^,]+)" | eval allowed_groups=split(group_lookup,"::") | eval temp=mvdedup(mvappend(group_name,allowed_groups)) | eval user=if(mvcount(temp)=(mvcount(group_name) + mvcount(allowed_groups)),user,null) | search user!=null | table user host Object_Name allowed_groups group_name temp The lookup_wild_folder CSV structure is still the same: server,folder_lookup,folder_out,group_lookup,user_lookup,file_exceptions SERVERNAME,D:Docstore*,D:Docstore,GROUP1::Group2,::USER1::USER2::USER3::, ... View more

This sanitized event will be a false positive, triggering the alert when it should not: 03/01/2016 10:42:26 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4663 EventType=0 Type=Information ComputerName=SERVER.DOMAIN.COM TaskCategory=File System OpCode=Info RecordNumber=100125574 Keywords=Audit Success Message=An attempt was made to access an object. Subject: Security ID: DOMAIN\USERNAME Account Name: USERNAME Account Domain: DOMAIN Logon ID: 0xc93b0ff0 Object: Object Server: Security Object Type: File Object Name: D:\FOLDER\PROTECTED.XLSX Handle ID: 0x1418 Process Information: Process ID: 0x4 Process Name: Access Request Information: Accesses: ReadData (or ListDirectory) Access Mask: 0x1 It triggers with the following statistics: user: USERNAME host: SERVER.DOMAIN.COM Object_Name: D:\FOLDER\PROTECTED.XLSX allowed_groups: ALLOWED_GROUP1 ALLOWED_GROUP2 group_names: RANDOM_GROUP1 RANDOM_GROUP2 ALLOWED_GROUP2 RANDOM_GROUP3 You can see that the user is a member of ALLOWED_GROUP2, which is one of the two allowed groups to this file. ... View more

Unfortunately this is still showing false positives. I had tried something similar to this on an initial version of the search but never was able to make it work. ... View more

This fixed the issue for me as well, thank you! ... View more

Regenerating the API key after renaming the folder resolved the issue. Thank you for your suggestion! ... View more

This is what we currently have configured for our user: Privileges Read/write access ISI_PRIV_LOGIN_CONSOLE N/A ISI_PRIV_LOGIN_PAPI N/A ISI_PRIV_LOGIN_SSH N/A ISI_PRIV_ANTIVIRUS Read-only ISI_PRIV_AUDIT Read-only ISI_PRIV_CLUSTER Read-only ISI_PRIV_DEVICES Read-only ISI_PRIV_EVENT Read-only ISI_PRIV_FTP Read-only ISI_PRIV_HDFS Read-only ISI_PRIV_HTTP Read-only ISI_PRIV_ISCSI Read-only ISI_PRIV_JOB_ENGINE Read-only ISI_PRIV_LICENSE Read-only SI_PRIV_NDMP Read-only ISI_PRIV_NETWORK Read-only ISI_PRIV_NFS Read-only ISI_PRIV_NTP Read-only ISI_PRIV_QUOTA Read-only ISI_PRIV_REMOTE_SUPPORT Read-only ISI_PRIV_SMARTPOOLS Read-only ISI_PRIV_SMB Read-only ISI_PRIV_SNAPSHOT Read-only ISI_PRIV_STATISTICS Read-only ISI_PRIV_SYNCIQ Read-only ISI_PRIV_VCENTER Read-only ISI_PRIV_WORM Read-only ... View more

That got most of the way. I now see data coming into index nessus, specifically sourcetype=nessus:plugin. Unfortunately, I do not seem to be getting any sourcetype=nessus:scan data. Searching for index=internal sourcetype=ta:nessus:log again gets me the following data for the run today: 11/4/15 2:07:37.456 PM 2015-11-04 14:07:37,456 ERROR pid=5201 tid=MainThread file=nessus_rest_client.py:request:91 | Failed to connect https://axe1util03p.anixter.com:8834/plugins/families/21, reason=Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/nessus_rest_client.py", line 79, in request headers=headers) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/init.py", line 1593, in request (response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/init.py", line 1335, in _request (response, content) = self._conn_request(conn, request_uri, method, body, headers) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/init.py", line 1291, in _conn_request response = conn.getresponse() File "/opt/splunk/lib/python2.7/httplib.py", line 1073, in getresponse response.begin() File "/opt/splunk/lib/python2.7/httplib.py", line 415, in begin version, status, reason = self._read_status() File "/opt/splunk/lib/python2.7/httplib.py", line 371, in _read_status line = self.fp.readline(_MAXLINE + 1) File "/opt/splunk/lib/python2.7/socket.py", line 476, in readline data = self._sock.recv(self._rbufsize) File "/opt/splunk/lib/python2.7/ssl.py", line 714, in recv return self.read(buflen) File "/opt/splunk/lib/python2.7/ssl.py", line 608, in read v = self._sslobj.read(len or 1024) SSLError: ('The read operation timed out',) Collapse host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:06:01.359 PM 2015-11-04 14:06:01,359 ERROR pid=5201 tid=MainThread file=nessus_rest_client.py:request:91 | Failed to connect https://axe1util03p.anixter.com:8834/plugins/families/2, reason=Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/nessus_rest_client.py", line 79, in request headers=headers) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/init.py", line 1593, in request (response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/init.py", line 1335, in _request (response, content) = self._conn_request(conn, request_uri, method, body, headers) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/init.py", line 1291, in _conn_request response = conn.getresponse() File "/opt/splunk/lib/python2.7/httplib.py", line 1073, in getresponse response.begin() File "/opt/splunk/lib/python2.7/httplib.py", line 415, in begin version, status, reason = self._read_status() File "/opt/splunk/lib/python2.7/httplib.py", line 371, in _read_status line = self.fp.readline(_MAXLINE + 1) File "/opt/splunk/lib/python2.7/socket.py", line 476, in readline data = self._sock.recv(self._rbufsize) File "/opt/splunk/lib/python2.7/ssl.py", line 714, in recv return self.read(buflen) File "/opt/splunk/lib/python2.7/ssl.py", line 608, in read v = self._sslobj.read(len or 1024) SSLError: ('The read operation timed out',) Collapse host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:05:17.403 PM 2015-11-04 14:05:17,403 ERROR pid=5201 tid=MainThread file=nessus_rest_client.py:request:91 | Failed to connect https://axe1util03p.anixter.com:8834/plugins/families/1, reason=Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/nessus_rest_client.py", line 79, in request headers=headers) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/init.py", line 1593, in request (response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/init.py", line 1335, in _request (response, content) = self._conn_request(conn, request_uri, method, body, headers) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/init_.py", line 1291, in _conn_request response = conn.getresponse() File "/opt/splunk/lib/python2.7/httplib.py", line 1073, in getresponse response.begin() File "/opt/splunk/lib/python2.7/httplib.py", line 415, in begin version, status, reason = self._read_status() File "/opt/splunk/lib/python2.7/httplib.py", line 371, in _read_status line = self.fp.readline(_MAXLINE + 1) File "/opt/splunk/lib/python2.7/socket.py", line 476, in readline data = self._sock.recv(self._rbufsize) File "/opt/splunk/lib/python2.7/ssl.py", line 714, in recv return self.read(buflen) File "/opt/splunk/lib/python2.7/ssl.py", line 608, in read v = self._sslobj.read(len or 1024) SSLError: ('The read operation timed out',) Collapse host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:11.133 PM 2015-11-04 14:04:11,133 ERROR pid=5205 tid=MainThread file=nessus.py:get_nessus_modinput_configs:157 | Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/nessus.py", line 147, in get_nessus_modinput_configs input_conf = config.get_data_input(input_name) File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/nessus_config.py", line 186, in get_data_input check_conf_mgr_result(False, "Cannot get the encrypted keys.") File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/nessus_config.py", line 27, in check_conf_mgr_result raise NessusConfigException(msg) NessusConfigException: Cannot get the encrypted keys. Collapse host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:11.132 PM 2015-11-04 14:04:11,132 ERROR pid=5205 tid=MainThread file=nessus.py:get_nessus_modinput_configs:156 | Failed to setup config for nessus TA: Cannot get the encrypted keys. host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:11.132 PM 2015-11-04 14:04:11,132 ERROR pid=5205 tid=MainThread file=nessus_config.py:check_conf_mgr_result:26 | Cannot get the encrypted keys. host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:10.981 PM 2015-11-04 14:04:10,981 INFO pid=5205 tid=MainThread file=nessus.py:get_nessus_modinput_configs:142 | Set loglevel to WARN host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:10.966 PM 2015-11-04 14:04:10,966 INFO pid=5201 tid=MainThread file=nessus.py:get_nessus_modinput_configs:142 | Set loglevel to WARN host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:10.710 PM 2015-11-04 14:04:10,710 INFO pid=5201 tid=MainThread file=nessus_config.py:_encrypt_nessus_conf:206 | Proxy username is empty. Try to delete the encrypted proxy username & password host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:10.710 PM 2015-11-04 14:04:10,710 INFO pid=5201 tid=MainThread file=nessus_config.py:_encrypt_nessus_conf:198 | Encrypt the proxy username & password host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:10.710 PM 2015-11-04 14:04:10,710 INFO pid=5201 tid=MainThread file=nessus_config.py:update_nessus_conf:66 | Update nessus.conf host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:10.709 PM 2015-11-04 14:04:10,709 INFO pid=5201 tid=MainThread file=nessus_config.py:get_nessus_conf:80 | Try to get encrypted proxy username & password host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:10.689 PM 2015-11-04 14:04:10,689 INFO pid=5205 tid=MainThread file=nessus_config.py:_encrypt_nessus_conf:206 | Proxy username is empty. Try to delete the encrypted proxy username & password host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:10.689 PM 2015-11-04 14:04:10,689 INFO pid=5205 tid=MainThread file=nessus_config.py:_encrypt_nessus_conf:198 | Encrypt the proxy username & password host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:10.689 PM 2015-11-04 14:04:10,689 INFO pid=5205 tid=MainThread file=nessus_config.py:update_nessus_conf:66 | Update nessus.conf host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:10.689 PM 2015-11-04 14:04:10,689 INFO pid=5205 tid=MainThread file=nessus_config.py:get_nessus_conf:80 | Try to get encrypted proxy username & password host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:10.335 PM 2015-11-04 14:04:10,335 INFO pid=5205 tid=MainThread file=nessus.py:main:260 | Start nessus TA host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log 11/4/15 2:04:09.876 PM 2015-11-04 14:04:09,876 INFO pid=5201 tid=MainThread file=nessus.py:main:260 | Start nessus TA host = axe1splkh01p.anixter.com source = /opt/splunk/var/log/splunk/ta_nessus.log sourcetype = ta:nessus:log ... View more