Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About zestep
zestep
New Member
Member since:
02-20-2018
06-05-2020
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-20-2018 |
Activity Feed
- Posted Re: Set-up Page in Carbon Black Defense App just spins - what is wrong? on All Apps and Add-ons. 01-10-2019 10:01 AM
- Posted How to make cluster map drilldown link to related search? on Splunk Enterprise Security. 03-07-2018 07:20 AM
- Tagged How to make cluster map drilldown link to related search? on Splunk Enterprise Security. 03-07-2018 07:20 AM
- Tagged How to make cluster map drilldown link to related search? on Splunk Enterprise Security. 03-07-2018 07:20 AM
- Tagged How to make cluster map drilldown link to related search? on Splunk Enterprise Security. 03-07-2018 07:20 AM
- Tagged How to make cluster map drilldown link to related search? on Splunk Enterprise Security. 03-07-2018 07:20 AM
- Posted Re: Splunk SDK for Python: Why am I unable to access the top-level keys from outside of the orig_raw field within my adaptive response action? on Building for the Splunk Platform. 02-20-2018 10:05 AM
- Posted Re: Splunk SDK for Python: Why am I unable to access the top-level keys from outside of the orig_raw field within my adaptive response action? on Building for the Splunk Platform. 02-20-2018 10:04 AM
- Posted Splunk SDK for Python: Why am I unable to access the top-level keys from outside of the orig_raw field within my adaptive response action? on Building for the Splunk Platform. 02-20-2018 07:24 AM
- Tagged Splunk SDK for Python: Why am I unable to access the top-level keys from outside of the orig_raw field within my adaptive response action? on Building for the Splunk Platform. 02-20-2018 07:24 AM
- Tagged Splunk SDK for Python: Why am I unable to access the top-level keys from outside of the orig_raw field within my adaptive response action? on Building for the Splunk Platform. 02-20-2018 07:24 AM
- Tagged Splunk SDK for Python: Why am I unable to access the top-level keys from outside of the orig_raw field within my adaptive response action? on Building for the Splunk Platform. 02-20-2018 07:24 AM
- Tagged Splunk SDK for Python: Why am I unable to access the top-level keys from outside of the orig_raw field within my adaptive response action? on Building for the Splunk Platform. 02-20-2018 07:24 AM
Topics I've Started
01-10-2019
10:01 AM
The Add-on doesn't have any real configuration other than configuring one or more modular inputs to splunk in the 'input' part of the Add-ons UI.
GUI Configuration
Start the Cb Defense Add-on in Splunk
Go to the "Inputs" tab - "Create new input" page and fill in the following fields:
Enter the API hostname for your Cb Defense instance in the url field - for most customers this will be "api5.conferdeploy.net". If unsure, contact your support representative.
Set apikey to your API key and the connector ID to your connector ID
Set "name" to anything (for example "cbdefense")
Set "interval" to 60 seconds (the polling interval of the Cb Defense notifications API)
Set "index" to whatever Splunk index you'd like the Add-On to place Cb Defense events into
The 2.X Add-on for Splunk supports as many rest-inputs as a user desires. If you would like to integrate with multiple Cb Defense Servers/Connectors simply define multiple inputs.
The Cb Defense Add-On for Splunk uses Splunk’s encrypted credential storage facility to store the API token for your Cb Defense server, so the API key is stored securely on the Splunk server.
... View more
03-07-2018
07:20 AM
<title>Registered Devices (Map)</title>
<search>
<query>| devicesearch query="$sensor_search$" | spath | where status="REGISTERED" | iplocation
lastExternalIpAddress | geostats latfield=lat longfield=lon count by lastExternalIpAddress
</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="mapping.drilldown">none</option>
<option name="mapping.type">marker</option>
<option name="refresh.display">progressbar</option>
</map>
I have a panel in a dashboard as shown, I need to fix the drilldowns so that they link to the configured search w/ the relevant ranges for LAT/LONG pairs. I seem to be able to make this quasi-work, by enabling all drilldowns - I would like the map to not zoom as a drilldown, but instead just link to the search.
I have looked at the relevant documentation but can't make heads or tails of it. Other than all/none for drilldown options, or specifying the link and the search explicitly - is there an option to only do the link to search drilldown?
V/r,
ZE
... View more
02-20-2018
10:05 AM
The code works great. The result dictionary looks like { .... "orig_raw" : {my original json} } when I would prefer the original json to appear at the top level in the result-set. I think it's just a matter of configuring things correctly? What controls this?
... View more
02-20-2018
10:04 AM
session_key = modaction.session_key
modaction.addinfo()
## process results
if not os.path.exists(modaction.results_file):
logger.info("No results available to process: %s does not exist, exiting." % modaction.results_file)
sys.exit(0)
with gzip.open(modaction.results_file, 'rb') as fh:
for num, result in enumerate(csv.DictReader(fh)):
## set rid to row # (0->n) if unset
result.setdefault('rid', str(num))
modaction.update(result)
modaction.invoke()
act_result = modaction.dowork(result)
if act_result:
modaction.message('Successfully Changed Policy', status='success')
else:
modaction.message('Failed to change Policy', status='failure', level=logging.ERROR)
modaction.writeevents(source='carbonblackdefenseapi')
... View more
02-20-2018
07:24 AM
I'm using the splunk SDK for python to create an adaptive response action!
My events are well-structured JSON objects - but from within my adaptive response ation I am not able to access the top-level keys from outside of the orig_raw field. Is this normal? How can I control this?
---code---
def do_genericevent(result):
field = result.get(field_name)
--code--
I have some incoming JSON events like { "key" : "value" } but in the 'result' dictionary within my adaptive response action these are all shelved under "orig_raw". Is this normal?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
