Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gf13579
gf13579
Communicator
Member since:
07-27-2017
06-10-2022
Community Statistics
| Posts | 62 |
| Solutions | 11 |
| Karma Given | 16 |
| Karma Received | 13 |
| Member Since | 07-27-2017 |
Activity Feed
- Got Karma for Re: How can I do a rising-column DBConnect query with a table join?. 02-02-2024 04:28 AM
- Got Karma for How can I setup a resilient DB Connect input with Splunk Cloud?. 10-20-2022 06:46 PM
- Got Karma for Re: Why is syslog-ng dropping events sent to SC4S's destination d_hec_fmt?. 02-25-2022 12:51 PM
- Posted Re: Why is syslog-ng dropping events sent to SC4S's destination d_hec_fmt? on Getting Data In. 12-22-2021 04:43 PM
- Posted Why is syslog-ng dropping events sent to SC4S's destination d_hec_fmt? on Getting Data In. 12-22-2021 04:39 PM
- Posted Re: A link to another apps in navigation menu on Dashboards & Visualizations. 11-02-2021 09:28 PM
- Got Karma for Re: Fill in 0 for timechart with missing values. 09-10-2021 06:13 AM
- Posted Re: Do apps built using Add-On Builder require changes for JQuery 3.5? on Splunk Dev. 08-10-2021 05:02 PM
- Posted Do apps built using Add-On Builder require changes for JQuery 3.5? on Splunk Dev. 04-11-2021 04:51 PM
- Tagged Do apps built using Add-On Builder require changes for JQuery 3.5? on Splunk Dev. 04-11-2021 04:51 PM
- Posted Re: Can you call a phantom action from a different app? on Splunk SOAR (f.k.a. Phantom). 09-16-2020 03:42 PM
- Posted Re: How can I close a Notable from Phantom? on Splunk SOAR (f.k.a. Phantom). 08-19-2020 05:21 AM
- Got Karma for Re: How can I close a Notable from Phantom?. 08-18-2020 11:45 PM
- Posted Re: Why don't I see Splunk events for containers with Phantom-ingested emails? on Splunk SOAR (f.k.a. Phantom). 07-29-2020 03:02 AM
- Posted Why don't I see Splunk events for containers with Phantom-ingested emails? on Splunk SOAR (f.k.a. Phantom). 07-29-2020 02:56 AM
- Posted Re: Is it impossible to use Phantom's ibackup on a warm standby server? on Splunk SOAR (f.k.a. Phantom). 07-23-2020 04:24 PM
- Karma Re: Is it impossible to use Phantom's ibackup on a warm standby server? for richgalloway. 07-23-2020 04:16 PM
- Posted Is it impossible to use Phantom's ibackup on a warm standby server? on Splunk SOAR (f.k.a. Phantom). 07-22-2020 06:49 PM
- Posted Re: How can I close a Notable from Phantom? on Splunk SOAR (f.k.a. Phantom). 07-20-2020 05:43 PM
- Posted How can I close a Notable from Phantom? on Splunk SOAR (f.k.a. Phantom). 07-20-2020 05:40 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
02-02-2024
04:29 AM
thanks for the post, helped me solve a very similar issue that I`ve encountered.
... View more
05-15-2023
12:05 AM
Hi Nick, For the Sophos Central if is on Sophos cloud is it also can use this TA you have created. Please advise.
... View more
04-24-2023
06:27 AM
High availability for DBX on Search Head Cluster on classic stack will be added in version 3.13 which will be released soon. It was introduced on Cloud SHC in version 3.11.
... View more
05-27-2022
06:12 PM
1 Karma
I know that this is an old thread, however, after a lot of browsing I was able to make AWS pipe AWS Flow logs to Splunk HEC with letsencrypt cert and without needing to use ACM. All one has to do is see if they get correct letsencrypt cert when you browse to HEC endpoint like so. curl -k https://yoursplunkinstanceDOTcom:8088/services/collector/event -H "Authorization: Splunk <Token>" -d '{"event":"hello world"}' -v If you don't see your letsencrypt cert here. You have to create a combinedsplunk.pem from these three files. cd /etc/letsencrypt/live/your-server-hostname/
cat cert.pem privkey.pem chain.pem > /opt/splunk/etc/auth/viewdns/combinedsplunk.pem
chmod 600 /opt/splunk/etc/auth/viewdns/combinedsplunk.pem
chgrp splunk:splunk /opt/splunk/etc/auth/viewdns/combinedsplunk.pem Then you have to create inputs.conf file and ensure it is readable by splunk user. cd /opt/splunk/etc/system/local/
cat inputs.conf
[http]
disabled = 0
index = main
enableSSL = 1
serverCert = /opt/splunk/etc/auth/yoursplunkinstance/combinedsplunk.pem
sslPassword =
crossOriginSharingPolicy = * Then restart splunk. /opt/splunk/bin/splunk restart
Now you should be able to go to HEC without any SSL error even without the -k switch in curl which asks curl to ignore SSL cert errors. curl https://yoursplunkinstanceDOTcom:8088/services/collector/event -H "Authorization: Splunk <Token>" -d '{"event":"hello world"}' -v
... View more
12-22-2021
04:43 PM
1 Karma
This can happen when you're trying to send to an index that doesn't exist. You can confirm this by turning on logging to d_hec_debug in /opt/sc4s/env_file and looking at the index-named folder list in /opt/sc4s/archive/debug and confirming all of those indexes exist. Create the index or update splunk_metadata.csv to change the destination index for a given source key. Thanks mbonsack in the sc4s community slack channel for the guidance. Posting here for visibility/googling.
... View more
11-02-2021
09:28 PM
Are you sure it's the ?, and not the ampersands? Try changing any & characters to & in the url. e.g. <a href="/app/lookup_editor/lookup_edit?owner=nobody&namespace=my_app&lookup=my_lookup&type=kv">Edit Lookup</a>
... View more
08-10-2021
05:02 PM
Answering my own question using the email sent in late July: Splunk recently released Add-on Builder v4.0.0 . If you built your Splunkbase solution with a prior release of Add-on Builder, please update your app(s) as soon as possible, and no later than August 31, 2021, using this latest version so that your Splunkbase app(s) will be compatible with the next major releases of Splunk Cloud Platform and Splunk Enterprise. As we move to newer versions of Python and jQuery in the platform, we have updated Add-on Builder to support them. That means that the current release of your application(s) based on the prior Add-on Builder release will not be compatible with the new Splunk releases coming later this year. You can find more information about this latest Add-On Builder release in the Splunk Add-on Builder Use Guide . To update your add-on, you will need to export your current project, then import it into this new Add-on Builder release. You can find more information in the “Import and export an add-on project ” section of the user guide.
... View more
07-07-2021
03:54 AM
Hi, thank you for the response. It works, but what if I have multiple fields in my stats but only want to show 0s for one of them? Thank you very much!
... View more
09-16-2020
03:42 PM
Hi @phanTom I don't actually want to call it from a custom function, I was just observing that you can't do that. I wanted to call another app's action from my custom app. I realised I could've just done a POST against /rest/action_run from my custom app to achieve what I was trying to do.
... View more
09-16-2020
02:09 AM
1 Karma
@gf13579 I recently saw this at a customer and got the same thing. I guess it makes sense that as the DB is constantly being streamed to the STBY i makes sense that a backup might be hard/impossible. For the customer I implemented the same cron job on both servers and monitored the backup logs. We tested in a DR scenario and the backup was successfully created when the STBY was made PRI.
... View more
08-19-2020
05:21 AM
Hi mzambrana123, Thanks for the candid feedback, but I'm not sure you've understood the question correctly. The problem isn't sending a Notable to Phantom, it's using Phantom to tell ES the Notable should be closed. If you're using latest version of the Splunk app within Phantom (1.3.41 at the time of writing) the action to update a status is broken as it assumes that notables will have an entry in the Incident Review lookup, which isn't true until someone makes a change to the case in ES i.e. assigns it to an analyst, changes, the status, leaves a comment etc.
... View more
07-29-2020
03:02 AM
The json logged by Phantom break's Splunk's parsing. Early fields in the json will be available for you to search on, but later fields such as label and status won't be automatically extracted. I think the raw_email field is the one that breaks things. Based on a quick test, a json linter had no problem with what phantom was sending Splunk, so the issue seems more with Splunk parsing the dta. As a workaround - extract the relevant fields at search time (or define your own local props): index=phantom_container
| rex "\x22label\x22: \x22(?<label>[^\x22]+)\x22"
| rex "\x22status\x22: \x22(?<status>[^\x22]+)\x22"
| search label!="servicenow-poll" status=new
| eval _time = strptime(create_time,"%Y-%m-%dT%H:%M:%S") + 10*60*60
| stats min(_time) as _time, values(label) as label by id
| timechart span=10m count by label
... View more
06-23-2020
05:18 PM
When I run Get Users against the group named G-SomeGroup it returns just 1 result. The group contains 3 members I can see from using PowerShell's Get-ADGroupMembers cmdlet that the group contains 3 users. I'm running PowerShell as the same AD user I've configured the LDAP asset in Phantom to use. The users in G-SomeGroup are direct members - no not members via nesting. If I query G-SomeOtherGroup I see hundreds of members. Any suggestions? Or logs to check?
... View more
Labels
- Labels:
-
troubleshooting
-
using Phantom
12-12-2019
02:18 AM
Thank you @gf13579 it worked!!! I will Accept the answer.
... View more
02-19-2020
07:24 AM
I second deepamshah's comment, looking for 14.2 RU2 MP1 field parsers also.
... View more
01-13-2019
02:31 PM
It turned out that limits.conf was the problem, weirdly.
There was a complete - and possibly modified - copy of the 6.6.2 defaults/limits.conf placed in local/. After removing this the upgraded environment (7.2.1) worked fine - columns were sorted as expected, preventing line charts of timechart data from appearing incorrectly.
... View more
11-12-2018
05:28 PM
I completely agree with my understanding of the issue presented doesn't align with the problem presented. There should be a little further dialogue to explain why the output determined the incorrect usage of the compile_app.pyc command. Thanks for the help chris_splunk!
... View more
09-11-2019
08:40 AM
Hi even I am exactly looking something same , I have lots of port activity notable events. Can you suggest how did you tune XS .
... View more
03-01-2018
04:31 PM
The correlation search 'Completely Inactive Accounts' makes use of the Access Tracker lookup, which records the most recent successful auth dates by user and dest.
The search that drives updates to Access Tracker requires that a succesful auth event has a value for dest.
A quick glance at that successful authentication events from our DC security logs show that the majority don't log a dest field.
sourcetype=XmlWinEventLog:Security tag=authentication action=success | fillnull | top EventCode, subject, dest
Those events all match the CIM constraints for a successful auth, but lack a dest. They make up about 95% of all the successful auths from the domain controller logs:
EventCode subject
4776 The domain controller attempted to validate the credentials for an account
4624 An account was successfully logged on
4672 Special privileges assigned to new logon
4769 A Kerberos service ticket was requested
The only one I'm seeing with a dest is 'A logon was attempted using explicit credentials', which appears to be just that - an attempt to logon to the domain controller, rather than just authenticate.
I'm reluctant to eval dest to be the name of the DC for those event codes just to make the access tracker work - as I'm not sure whether there are other searches I could negatively impact by populating dest here.
Another option that comes to mind is to setup a custom version of access tracker that hard-codes dest to be host (available to tstats) where it's missing.
Also, I realise we could just give up; add LastLogonDate to our LDAP lookup and report on old AD accounts.
Anyone come across this and implemented a practical way of achieving valid results for 'Completely Inactive Accounts'?
... View more
03-07-2018
03:52 PM
1 Karma
You are right you can use validate_input() method. Just raise an exception like this:
raise Exception("error message")
Then the error will be shown in UI.
... View more
03-05-2018
08:07 PM
1 Karma
And also I know we can check the current threshold level for this using extreme search
| inputlookup network_traffic.context.csv
| table class,concept,center,count,domainMax,domainMin,points,size,type
Add this to look at a given port:
| search class=9571
Check the 3 pipe-separated values in points, per concept, e.g.:
extreme 5|10|15
... View more
04-02-2018
05:01 PM
Not easily.
There's a saved search in ES that populates the malware_operations_tracker lookup based on those events matching the malware and operations tags - which includes some of the Fortigate events, based on your TA.
That tracker is used to populate key indicators like 'Malware - Old Malware Definitions' i.e. clients that haven't checked in and updated in a while.
To be honest, I've forgotten why this seemed like a problem - maybe it seemed more significant because our AV solution (Sophos Central) wasn't populating the malware ops tracker but Fortigates were.
Ignore this one for now!
... View more
11-22-2017
07:32 AM
We had this same issue after upgrade to 4.7.0 - Splunk Support advised it was a bug in this version and provided the following fix, which worked for us -
Edit splunk/etc/apps/DA-ESS-ThreatIntelligence/bin/configuration_checks/confcheck_failed_threat_download.py as below:
--- confcheck_failed_threat_download.old.py
+++ confcheck_failed_threat_download.py
@@ -33,7 +33,7 @@
messages = []
- job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest=earliest)
+ job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest_time=earliest)
while elapsed < srch_timeout:
if job.isDone:
if job.resultCount > 0 or job.eventCount > 0:
... View more
08-14-2019
07:08 AM
1 Karma
the SEDCMD-remove_ffff is already present and commented in Splunk_TA_windows version 6.0 (but dont change in default file)
so you could just :
create/update Splunk_TA_Windows/local/props.conf
[source::WinEventLog:Security]
SEDCMD-remove_ffff = s/::ffff://g
[source::WinEventLog:ForwardedEvents]
SEDCMD-remove_ffff = s/::ffff://g
[WMI:WinEventLog:Security]
SEDCMD-remove_ffff = s/::ffff://g
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-10-2022
12:30 AM
|
Karma given to
