Hi Shane, I am trying to run an Oracle connection using SSL. It is running at AWS/RDS and I downloaded the root and intermediate certs from AWS and imported these in /usr/lib/jvm/java-1.8.0-openjdk/jre/lib/security/cacerts as well as in the keystore and truststore files in DB Connect in /opt/splunk/etc/apps/splunk_app_db_connect/certs/ but I see you added the certs somewhere else, did you create a new jks file in /opt/splunk/etc/apps/splunk_app_db_connect/keystore/ or import your cert in /opt/splunk/etc/apps/splunk_app_db_connect/keystore/default.jks because I am not able to add the cert in /opt/splunk/etc/apps/splunk_app_db_connect/keystore/default.jks using the default "password" password; it doesn't seem to be "password" Thanks for your help. ... View more

Hi Vijayakumarkb, I wonder if you were able to resolve this because I cam getting the exact same error. things I did: Used ojdbc8.jar (v 12.2) Imported the cert pem in both the Java store as well as the DB Connect trustore in /opt/splunk/etc/apps/splunk_app_db_connect/certs/ Running curl as in curl --cacert /tmp/certname.pem -v https://hostname:portnumber is successful however in DB connect under connection I am getting: "IO Error: Received fatal alert: handshake_failure, connect lapse 1 ms., Authentication lapse 0 m" I am using DB Connect v 3.1.4 + Java v 1.8.0 Thanks ... View more

@haoban - thanks for taking the time to provide all this. Much appreciated. ... View more

@haoban - Thanks for your response. Ok I'll work with the Firepower admin to configure the FMC to send the connection events; so it seems it is a setting on the FMC side and not on the TA-eStreamer side; is that correct? Reason I am seeing is that on the TA-eStreamer add-configuration page there a setting under "data" to collect the "connections" though it doesn't seem it is doing anything when checked. As far as transforms.conf - it seems to me you are trying to ingest in Splunk ONLY the security intelligence traffic, hence the REGEX = sec_intel_list1 then sending that stream to your tcpout group name(s) in outputs.conf while your tcpout stanza in outputs.conf is called "default-autolb-group" and sending everything else (hence REGEX = .) to the nullQueue - is that what you are trying to do? Thanks. ... View more

Hey Haoban - how are you getting the security intelligence logs from Firepower? I am also using the same TA (TA-eStreamer) but the only traffic that seems to be coming from Firepower is intrusion detection and malware events. I am not seeing any events with sec_intel_event=yes ... View more

hey guys, I deployed the TA on our Splunk deployment and it is behind a firewall. So I edited both input_module_MS_AAD_audit.py and input_module_MS_AAD_signins.py as such: proxies = { 'http': 'http://my-proxy-server:3128', 'https':'http://my-proxy-server:3128', } r = requests.get(url,proxies=proxies,headers=header) ### r = requests.get(url, headers=header) But I am seeing this error: 12-10-2018 16:37:11.737 -0500 ERROR ExecProcessor - message from "python /splunk/app/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py" ERRORcannot concatenate 'str' and 'exceptions.KeyError' objects 12-10-2018 16:37:11.714 -0500 ERROR ExecProcessor - message from "python /splunk/app/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py" TypeError: cannot concatenate 'str' and 'exceptions.KeyError' objects 12-10-2018 16:37:11.714 -0500 ERROR ExecProcessor - message from "python /splunk/app/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py" header = {'Accept':'application/json', 'Authorization':'Bearer ' + access_token} 12-10-2018 16:37:11.714 -0500 ERROR ExecProcessor - message from "python /splunk/app/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py" File "/splunk/app/splunk/etc/apps/TA-MS-AAD/bin/input_module_MS_AAD_audit.py", line 90, in get_audit_events 12-10-2018 16:37:11.714 -0500 ERROR ExecProcessor - message from "python /splunk/app/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py" audit_events = get_audit_events(helper, access_token, url, max_records) 12-10-2018 16:37:11.714 -0500 ERROR ExecProcessor - message from "python /splunk/app/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py" File "/splunk/app/splunk/etc/apps/TA-MS-AAD/bin/input_module_MS_AAD_audit.py", line 129, in collect_events 12-10-2018 16:37:11.714 -0500 ERROR ExecProcessor - message from "python /splunk/app/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py" input_module.collect_events(self, ew) 12-10-2018 16:37:11.714 -0500 ERROR ExecProcessor - message from "python /splunk/app/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py" File "/splunk/app/splunk/etc/apps/TA-MS-AAD/bin/MS_AAD_audit.py", line 72, in collect_events I've plugged the Azure clientID and secretKey in the TA's config screen. What am I missing? Thanks. ... View more

Hey mmoermans, Did you figure a solution for this time gap between _time and indextime? We are having the same issue where the events _time can span anywhere from few minutes to up to 3 hours in comparison to indextime. I reduced the polling interval to 300 secs/5 minutes and no luck; still seeing the time gap. We are also using R80 Thanks. ... View more

Hey Panovattack, It looks to me that the expandiprange.py Python script that is called to populate the assets_by_cidr.csv lookup requires that the IP field in | asset_sources to be either an IP range (as in 10.250.20.01-10.250.20.255 ) or in CIDR notation (e.g. 10.0.0.0/8) if it is just an IP the lookup just doesn't populate because one of the macros regex down the | line filters on IPs in CIDR notations. So how did you get those CIDR entries in the IP or how did you populate the assets_by_cidr.csv lookup? Thanks. ... View more

Awesome thanks. I used the "simple XML" route and added a conditional panel that hide/displays depending upon returned events. As far as using JS, that means converting the panel from XML to HTML; is that correct? I came across this http://dev.splunk.com/view/SP-CAAAEM2 as far as configuring HTML panels; was wondering if you know of a more comprehensive developer guid on working with HTML panels; as in: JS validation on input fields. Grabbing field values from the result set. Looping through the result set. Thanks so much. ... View more

@ elliotproebstel - thanks so much for your answer, that solution worked 🙂 Is there a way to display an alert box or something if there is a field match between field A on lookup X and field B on lookup Y - just to notify/alert the user that the entered value will NO be appended to lookup X. Thanks. ... View more