Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About splunkmachine
splunkmachine
Explorer
Member since:
09-11-2017
06-05-2020
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 5 |
| Member Since | 09-11-2017 |
Activity Feed
- Got Karma for Version 8.0 and Python 3.0 Support. 06-05-2020 12:50 AM
- Got Karma for Azure Add-On Version 8.x Python 3.0 ready ?. 06-05-2020 12:50 AM
- Got Karma for Azure Add-On Version 8.x Python 3.0 ready ?. 06-05-2020 12:50 AM
- Got Karma for Azure Add-On Version 8.x Python 3.0 ready ?. 06-05-2020 12:50 AM
- Got Karma for Azure Add-On Version 8.x Python 3.0 ready ?. 06-05-2020 12:50 AM
- Posted Python 3.0 Roadmap on All Apps and Add-ons. 01-06-2020 04:24 AM
- Tagged Python 3.0 Roadmap on All Apps and Add-ons. 01-06-2020 04:24 AM
- Posted Azure Add-On Version 8.x Python 3.0 ready ? on All Apps and Add-ons. 01-06-2020 04:20 AM
- Tagged Azure Add-On Version 8.x Python 3.0 ready ? on All Apps and Add-ons. 01-06-2020 04:20 AM
- Posted Version 8.0 and Python 3.0 Support on All Apps and Add-ons. 12-20-2019 04:26 AM
- Tagged Version 8.0 and Python 3.0 Support on All Apps and Add-ons. 12-20-2019 04:26 AM
- Posted Re: Microsoft Azure Active Directory Add-on for Splunk - Azure AD Group Data on All Apps and Add-ons. 06-20-2019 05:06 AM
- Posted Re: Does Enterprise Security Threat Intelligence download feeds support normal web page input on Security. 06-19-2019 01:48 PM
- Posted Re: Does Enterprise Security Threat Intelligence download feeds support normal web page input on Security. 06-18-2019 12:02 PM
- Posted Does Enterprise Security Threat Intelligence download feeds support normal web page input on Security. 06-18-2019 01:29 AM
- Tagged Does Enterprise Security Threat Intelligence download feeds support normal web page input on Security. 06-18-2019 01:29 AM
- Tagged Does Enterprise Security Threat Intelligence download feeds support normal web page input on Security. 06-18-2019 01:29 AM
- Posted Microsoft Azure Active Directory Add-on for Splunk - Azure AD Group Data on All Apps and Add-ons. 06-12-2019 05:24 AM
- Tagged Microsoft Azure Active Directory Add-on for Splunk - Azure AD Group Data on All Apps and Add-ons. 06-12-2019 05:24 AM
- Posted Re: Does Splunk provide fully supported Docker universal forwarder ? on Getting Data In. 09-11-2017 10:34 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 4 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
01-06-2020
04:24 AM
Hi
Can you provide details of road map for release date that is python 3.0 ready ?
Are you currently developing/testing an add-on that is python 3.0 ready?
Thanks
... View more
01-06-2020
04:20 AM
4 Karma
Hi
Can you provide details of road map for release date that is python 3.0 ready ?
Are you currently developing/testing an add-on that is python 3.0 ready?
Thanks
... View more
12-20-2019
04:26 AM
1 Karma
Hi
Can you provide details of road map for release date that is python 3.0 ready ?
Are you currently developing/testing an add-on that is python 3.0 ready?
Thanks
... View more
06-20-2019
05:06 AM
I believe it would require a new import module writing - input_module_MS_AAD_group.py
url = "https://graph.microsoft.com/v1.0/groups?$expand=members"
... View more
06-19-2019
01:48 PM
Hi David
I tried your suggestion above which I tried also originally still parsing errors.
I went back to my originally
regex: (?^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})|(?\w+)|(?\d+)|(?\d+)|(?\w+)|(?\d+)|(?\w+\s+\S+)|(?[a-zA-Z&]\w+.*)?\
and removed delimiter this time setting fields
to ip:$1, description:"DAN_TOR-$3-$4-$5"
This worked!
... View more
06-18-2019
12:02 PM
Hi David
I've added quite a few URL based intelligence feeds which are typically a web page of IP's however, as my original post yes I'm stuck as I get parsing errors.
I've followed the instructions.
Here's the guide on how to add a webpage as a threat intel source for ES :
https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Downloadthreatfeed#Add_a_URL-based_threat_source
I've tried the following to extract the fields.
(?^\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})|(?\w+)|(?\d+)|(?\d+)|(?\w+)|(?\d+)|(?\w+\s+\S+)|(?[a-zA-Z&]\w+.*)?\
And listed the fields
I've tried using regular expressions to extract the fields, I've also tried to use a separator.
The download feed consists of 8 fields seperated by '|' symbol which start at line 155 in the web page.
The web page consists of html and each line consisting of the six fields has the following html
'
The fields are:
|||||||
Eight field is optional.
I've tested listing the fields in the notation as documented:
:$,.$
ip:$1,description:domain_blocklist
Checking the threat management log I see parsing failure.
... View more
06-18-2019
01:29 AM
We have a Tor threat intelligence feed that we require to add to Splunk Enterprise.
The intelligence feed is from dan . me . uk / tornodes
The format of the page is typically html followed by a starting tag _BEGIN_TOR_NODE_LIST
Does Splunk Enterprise Threat Intelligence download feeds support a HTML type of input ?
TOR Node List
This page contains a full TOR nodelist (updated at Mon Jun 17 19:31:39 BST 2019) in the format below.
There are tags of BEGIN_TOR_NODE_LIST and END_TOR_NODE_LIST for easy scripting use of this page.
You can also fetch https://www.dan.me.uk/torlist/ (FULL) or https://www.dan.me.uk/torlist/?exit (EXIT only) for a list of ips only, one per line - updated every 30 minutes. Ideal for constructing your own tor banlists.
NOTE: This is a FULL list including more than just exit nodes. If you only wish to block exit nodes you NEED to process the list to include only flags E and/or X!
You WILL upset people if you block the full list as many nodes do not permit exit.
|||||||
Total number of nodes is: 7680
192.2.1.200|hidden|9001|0|RV|64883|Tor 0.3.5.8|
192.0.1.168|hidden2|80|0|EFRDV|195782|Tor 0.3.5.7|decsription goes here
Internal IP's given for privacy reasons
Trying to use regular expressions to extract the fields fails
(?<ip>^\d{1,3}.\d{1,3}\.\d{1,3}.\d{1,3})\|(?<name>\w+)\|(?<directoryPort>\d+)\|(?<routerPort>\d+)\|(?<flags>\w+)\|(?<uptime>\d+)\|(?<version>\w+\s+\S+)\|(?<contactInfo>[a-zA-Z&]\w+.*)?\<br\s+\/\>
I've tried stating the number of lines to skip on the page and tried changing delimiter but it still comes back with parsing failure in the threat management log.
... View more
06-12-2019
05:24 AM
I've installed version Version 1.2.1 (June 10, 2019) of Microsoft Azure Active Directory Add-on for Splunk and can now obtain the Azure AD User data.
Is it possible to make a modification to the TA to collect the group data from Azure AD via a rest api to collect from microsoft graph.
... View more
09-11-2017
10:34 AM
There are several methods to forward events. The link you posted is for the docker supported driver to Splunk via HEC. We have been exploring using the Splunk dockerised UF in the open source project to forward events for a slightly different use case. The other method to explore next is forwarding events via Google Cloud PUB/SUB subscription
... View more
09-11-2017
08:23 AM
Thanks for the quick reply. Yes this makes perfect sense however, just exploring methods for forwarding/streaming events realtime from Google Cloud Container into Splunk on premise
... View more
09-11-2017
06:09 AM
We are looking at using the Docker Universal Forwarder for logging forwarding from the official GitHub Splunk repository.
https://github.com/splunk/docker-splunk/blob/master/universalforwarder/README.md
However, can you provide details on whether this is fully supported by Splunk ? Is a new version also release at each version update with Splunk ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
