All Apps and Add-ons

Implementing AES within Splunk DB Connect

ggssa2000
Explorer

There are two apps on Splunk, "Encrypt and Decrypt data within Events" and "Splunk DB Connect".
The purpose I want achieving is to combine the apps work together.

First, I setup a MySQL server, and using AES_ENCRYPT and AES_DECRYPT function
to encrypting/decryping data stored in the DB.
Anything went right when I typed the "SELECT" command at terminal, it will show correct decrypted data.

Note:
Here is the syntax I used to ENCRYPTION / DECRYPTION data at MySQL server:
ENCRYPTION: INSERT INTO HS VALUES ('',AES_ENCRYPT('final','12345'),AES_ENCRYPT('Frence','12345'),AES_ENCRYPT('78979456','12345'));
DECRYPTION: SELECT id ,AES_DECRYPT(name,'12345'),AES_DECRYPT(region,'12345'),AES_DECRYPT(SN,'12345') FROM HS;

When I installing the "Splunk DB Connect" app, to enable the SQL command at Splunk, however, there is problem occurred.
The syntax as the same as mentioned above didn't work correctly at Splunk Search, even the condition of select or the key of AES was correct. It was neither showed ciphertext nor garbled, just a series numbers.

So, I wonder that it may Splunk support the AES_DECRYPTION via the app "Encrypt and Decrypt data within Events",
but I can't figure out how to utilize it to implement the SQL language.

It will be nice if there exists solution, thanks a lot !

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, are you using the built-in jTDS driver? It's got a lot of limitations, and you'd probably have better luck using the Microsoft driver.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...