Hi, I have two index node cluster and one dedicated search head for ES APP. installed Splunk_TA for cisco ASA on the forwarders, indexers and search head . we are able to index the data with sourcetype=cisco:asa. When we search the data with search app we are able to get all the fields properly including the TAGs required for ES APP. (Ex: src, dst, network etc) but when we open with data models in the ES APP, most of the fields are showing unknown value. how to troubleshoot this siddiqu.T ... View more

Hi, I am trying to simulate a cluster environment for the Splunk App for Enterprise Security. The setup is: -Two Indexers in a cluster with Rep Factor =2 , search factor=2 -One search head for ES APP other one for third party apps. -Dedicated Cluster Master & Deployer on a single machine. I have installed the ES APP in the on the deployer and copied SA-ForIndexers, TA-*, Splunk_TA*, Splunk_SA* files to master-apps and pushed to the Indexer cluster. With this, it is able to create the indexes. Would like to know what are all the directories i need to copy/Push to the ES APP search head node? Do i need to create search head cluster, or just i can copy directly ES app related files for the search head? How do I ensure that the search head sends all the data to the Indexer cluster? Thanks siddiqu.T ... View more

Hi, i am Developing an app for integrating arbor pravail ddos logs. Extracted the fields and mapped to CIM. but when i am trying to access from security app dashboard, no reports are shown. sample log Oct 2 04:05:32 10.1.1.1 ddos pravail: Blocked Host: Blocked host 192.168.1.1 at 04:05 by TLS Attack Prevention using TCP/443 (HTTPS) destination 172.16.1.1 URL: https://internalurl props.conf [arbor_test] EXTRACT-category = (?i)^(?:[^ ]* ){5}(?P[^ ]+) EXTRACT-dest = (?i) destination (?P[^,]+) EXTRACT-dvc = (?i)^(?:[^ ]* ){4}(?P[^ ]+) EXTRACT-signature = (?i) by (?P\w+\s+\w+) EXTRACT-src = (?i) host (?P[^ ]+) EXTRACT-action = (?i) .*?: (?P\w+)(?= ) EXTRACT-dest_port = (?i) .*?/(?P\d+)(?= ) EXTRACT-url = (?i),URL: (?P.+) EXTRACT-arbor_signature = (?i) by (?P.+?)\s+\w+\s+\d+ LOOKUP-vendor_info_for_arbor_test = arbor_test_vendor_info_lookup.csv sourcetype OUTPUT ids_type,vendor,product,severity Eventtype [arbor_test] search = sourcetype=arbor_test Tags [eventtype=arbor_test] attack = enabled ids = enabled network = enabled communicate = enabled Lookup sourcetype vendor product ids_type severity arbor_test arbor IPS network critical Inputs are welcome. Sididqu.T ... View more