Hi, Can somebody suggest a threat intel app available (apary from ES) which allows us to add our IOCs for searching matching events. Thanks. ... View more

Hello All, Received below error while configuring Mimecast app for Splunkv2. message from "python "D:\Program Files\Splunk\etc\apps\Splunk_TA_mimecast_for_splunk_v2\bin\Splunk_TA_mimecast_for_splunk_v2.py"" Unexpected error getting base url. Cannot continue.[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:595) Appreciate any help to resolve this error. ... View more

Hi, Earlier we used to receive mimecast held messages in below format: date=2018-01-15T02:38:00+0000| mcType=mimecastHeld|to=recipient address|from=sender address|reason="Message Hold Applied - Spam Signature policy"|subject="subject" But since 15th jan, 2018 we are getting them in below format, datetime=2018-01-01T18:30:20+0000|aCode=|acc=|Hld=Spm|AttSize=0|Act=Hld|AttCnt=0|AttNames=|MsgSize=19484|MsgId=|mcType=process Now there is no way we can check information of any held message in Splunk? Any suggestions will help. Thanks in advance ... View more

Hi, We have a UF which forwards data to HF and HF passes it to indexers. UF forwards OS logs as well as logs from the directory that we are monitoring. We have configured HF to forward data received to indexers as well as to third party system as explained here: http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Forwarddatatothird-partysystemsd. But as checked only OS logs are getting forwarded and not the logs from the directory. Can anybody suggest the additional checks we should perform to ensure logs from the directory too are getting forwarded to third party system? Thanks. ... View more

Hi All, We have 300+ servers in our environment and already reporting to Splunk. We are trying to add 5 more servers but the communication between deployment client and deployment server is not getting established. Below is netstat output from deployment server. Active Connections Proto Local Address Foreign Address State TCP A.B.C.D:3389 ABC:65062 ESTABLISHED TCP A.B.C.D:8089 10.1.1.1:56008 TIME_WAIT TCP A.B.C.D:8089 1.2.2.4:56671 TIME_WAIT TCP A.B.C.D:8089 2.2.3.4:56673 TIME_WAIT We have checked telnet on port 8089 is working in both ways. Can you please suggests some checks that we should perform? Thanks in advance. ... View more