Hi, Running Splunk 9.0.7 and addon Splunk_TA_MS_Security version 2.1.1. I followed the instructions from the addon https://docs.splunk.com/Documentation/AddOns/released/MSSecurity/Configure and reviewed from Microsoft article  https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-hello-world?view=o365-worldwide Basically I created an App Registration in our Azure tenant, add the following permissions and created a secret   with all this, I followed the Microsot article and run the powershell scripts to test the connection and the token I obtain only gets a single permission.     could someone tell me what I am doing wrong? I expected to get all the permissions assigned to the application and I think that is why I get the 403 error in the splunkd.log. 12-17-2023 13:14:32.037 +0100 ERROR ExecProcessor [19404 ExecProcessor] - message from ""C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_MS_Security\bin\microsoft_defender_endpoint_atp_alerts.py"" 403 Client Error: Forbidden for url: https://api-eu.securitycenter.microsoft.com/api/alerts?$expand=evidence&$filter=lastUpdateTime+gt+2023-11-17T12:14:31Z 12-17-2023 13:17:38.251 +0100 ERROR ExecProcessor [19404 ExecProcessor] - message from ""C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\Splunk_TA_MS_Security\bin\microsoft_365_defender_endpoint_incidents.py"" 403 Client Error: Forbidden for url: https://api.security.microsoft.com/api/incidents?$filter=lastUpdateTime+gt+2023-11-17T12:17:31Z   thanks   ... View more

hi, I have splunk 9.0.6 and sysmon add-on 3.1.0.  The lookup table called "microsoft_sysmon_eventcode.csv" correctly appears in Splunk Lookup Table Files list.   But, in the automatic lookup, the Lookup-eventcode is wrongly assigned to "eventcode" lookup instead of "sysmon_eventcode".   Searching for this "eventcode" lookup, it belongs to the app Defender.   Surprisingly, when I tried to fix this bug using the UI, the sysmon_eventcode lookup table did not appear in the dropdown list. I only see "sysmon-record_type-lookup".   Do you have any idea what might be happening? ... View more

Hi,  quick summary of our deployment: - Splunk standalone 9.0.6 - PaloAlto Add-on and App freshly installed 8.1.0 - SC4S v3.4.4 sending logs to splunk - PA logs ingested in indexes and sourcetypes according SC4S official doc https://splunk.github.io/splunk-connect-for-syslog/main/sources/vendor/PaloaltoNetworks/panos/ - I see events in all indexes and with all sourcetypes. Indexes: netfw, netproxy, netauth, netops Sourcetypes: pan:traffic , pan:threat , pan:userid, pan:system, pan:globalprotect, pan:config What else do I need to do to make the official PaloAlto App to work? I checked the documentation https://pan.dev/splunk/docs/installation/  and I enable the data acceleration, and still no data is shown in any dashboard. I don't know what else is missing, any suggestion? thanks a lot ... View more

Hi, I have an issue with our HEC service in our Splunk standalone installation (9.0.6). It simply does not complete the TCP connection for some unknown reason. Local FW is OFF. Ping works but TCP does not complete the connection.   everything else works normally. I can connect to Splunk and search data, and universal forwarders report commonly (no deployment errors)... only HEC does not work as it should. HEC global settings from wireshark, the TCP retransmition can be seen but I can't find the root cause for it.   any idea of what could be happening? many thanks.       ... View more

Hi, I just deployed the latest version 2 of SC4S and I sent syslog events from our firewall Stormshield. I checked and I didn't see a specific source for this firewall brand The box is capable of sending logs in the format RFC5424, UDP/514. I did not configure a custom filter for it and the logs are automatically recognized as UNIX OS syslog events which is wrong, they are indexed in the osnix instead of netfw. I would like to create a filter based on the source host but I don't find any examples in the official github documentation.  for version 1 there is some but I am not sure if it applies to version 2. https://splunk.github.io/splunk-connect-for-syslog/1.110.1/configuration/#override-index-or-metadata-based-on-host-ip-or-subnet-compliance-overrides any suggestion? many thanks   ... View more

Hi, I need to collect the logs from Windows Defender and I was looking for an official app and I couldn't find one. I read some people recommending "TA for Microsoft Windows Defender" but I see that it didn't get update since 2017. Any other option more recent? thanks. ... View more

Hi, I had Splunk 9.05 and Syslog Conector for Splunk  (SC4S) 1.110 running and working for months. I just realized that there are not events ingested via HEC since two weeks ago. Both servers are in the same subnet, no firewall in between. - Local firewall of the server has a rule for the incoming TCP 8088 traffic. (screenshot attached) - HEC enabled (global settings screenshot attached) - HEC token is correct. It is the same in the SC4S and Splunk. - netstat in the Splunk server shows listening in the port 8088. (attached) - ping from SC4S to Splunk and curl on port splunk:80 works fine, if I do port splunk:8088 it throws a timeout. (attached) - local firewall in SC4S firewall-cmd --list-all drop (active) target: DROP icmp-block-inversion: yes interfaces: eth0 sources: services: ssh syslog syslog-tls ports: 514/tcp 601/tcp protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: echo-reply echo-request port-unreachable time-exceeded rich rules: any idea what else I could check? many thanks ... View more

Hi, I run Splunk 9.0.3 with IT Essentials 4.15.0 with Exchange content pack 1.5.1 (DA-ITSI-CP-microsoft-exchange). We have an Exchange 2016 deployment on-premises.  Reviewing the built-in dashboards,  I saw empty panels in some dashboards. An example is the panel "Outbound Message Volume" in the "Outbound Messages - Microsoft Exchange" dashboard. (see attachment)  I dug into the query and replaced all macros, the resulting query was: eventtype=smtp-outbound | join message_id [ search eventtype=storedriver-receive | fields message_id,sender] | eval sender=lower(sender) | eval sender_domain=lower(sender_domain) | eval sender_username=lower(sender_username) | eval recipients=lower(recipients)|eval recipient=lower(recipient)|eval recipient_domain=lower(recipient_domain)|eval recipient_username=lower(recipient_username) | table _time,message_id,sc_ip,sender,recipient_count,recipients,total_bytes | eval total_kb=total_bytes/1024 | timechart fixedrange=t bins=120 per_second(total_kb) as "Bandwidth" the chart is created based on the value of total_kb which is calculated based on the extracted field total_bytes. I removed the last command (timechart) and total_bytes does not exist, so total_kb is not calculated. I tried to find the issue and the eventtype corresponds to the sourcetype MSExchange:2013:MessageTracking  . I looked into the props.conf in the path <drive>:\Program Files\Splunk\etc\apps\DA-ITSI-CP-microsoft-exchange\default  and there are no evals created for the total_bytes field.  [MSExchange:2013:MessageTracking] SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false REPORT-fields = msexchange2013msgtrack-fields,msgtrack-extract-psender,msgtrack-psender,msgtrack-sender,msgtrack-recipients,msgtrack-recipient TRANSFORMS-comments = ignore_comments FIELDALIAS-server_hostname_as_dest = server_hostname AS dest FIELDALIAS-host_as_dvc = host AS dvc EVAL-src=coalesce(original_client_ip,cs_ip) EVAL-product = "Exchange" EVAL-vendor = "Microsoft" LOOKUP-event_id_to_action = event_id_to_action_lookup event_id OUTPUT action FIELDALIAS-user = sender_username AS user FIELDALIAS-orig_dest = ss_ip AS orig_dest FIELDALIAS-dest_ip = ss_ip AS dest_ip FIELDALIAS-return_addr = return_path AS return_addr FIELDALIAS-size = message_size AS size FIELDALIAS-subject = message_subject AS subject EVAL-orig_src=coalesce(original_client_ip,cs_ip) EVAL-protocol = "SMTP" EVAL-vendor_product = "Microsoft Exchange" EVAL-sender = coalesce(PurportedSender,sender) EVAL-src_user = coalesce(PurportedSender,sender) EVAL-sender_username = coalesce(psender_username,sender_username) EVAL-sender_domain = coalesce(psender_domain,sender_domain) I also checked msexchange2013msgtrack-fields entry in the transforms.conf and the field "total_bytes" appears there. [msexchange2013msgtrack-fields] FIELDS = "date_time","cs_ip","client_hostname","ss_ip","server_hostname","source_context","connector_id","source_id","event_id","internal_message_id","message_id","network_message_id","recipients","recipient_status","total_bytes","recipient_count","related_recipient_address","reference","message_subject","sender","return_path","message_info","directionality","tenant_id","original_client_ip","original_server_ip","custom_data" DELIMS = , As a final check, I look for the Exchange logs and the total_bytes field is included in the logs.  In the extract below the total_bytes appears in the correct position with a value of 55115. #Software: Microsoft Exchange Server #Version: 15.01.2507.021 #Log-type: Message Tracking Log #Date: 2023-05-18T09:00:00.691Z #Fields: date-time,client-ip,client-hostname,server-ip,server-hostname,source-context,connector-id,source,event-id,internal-message-id,message-id,network-message-id,recipient-address,recipient-status,total-bytes,recipient-count,related-recipient-address,reference,message-subject,sender-address,return-path,message-info,directionality,tenant-id,original-client-ip,original-server-ip,custom-data,transport-traffic-type,log-id,schema-version 2023-05-18T09:00:00.691Z,,HOST.xxx.y.z,,HOST,08DB13554C308059;2023-05-18T09:00:00.637Z;ClientSubmitTime:2023-05-18T09:00:00.117Z,,STOREDRIVER,DELIVER,140492675219457,<b133b1b22b184c049dacea930775bae5@xxx.yyy.z>,bfb98eea-8ce0-42a6-a016-08db577e42ed,mary@xx.y,,55115,1,,,RE: ArcGISDataDevTraining,john@xx.y,john@xx.y,2023-05-18T09:00:00.120Z;SRV=XXX.yy.z:TOTAL-SUB=0.234|SA=0.194|MTSS-PEN=0.041(MTSSD-PEN=0.037(MTSSDA=0.002|MTSSDC=0.008|SDSSO-PEN=0.012 (SMSC=0.008(X-SMSDR=0.001)|MTSSDM-PEN=0.004)));SRV=XXX.yyy.zz:TOTAL-HUB=270.010|SMR=0.145(SMRDI=0.006|SMRC=0.138(SMRCL=0.107|X-SMRCR=0.138))|CAT=0.124(CATORES=0.016 (CATRS=0.016(CATRS-Transport Rule Agent=0.004(X-ETREX=0.004)|CATRS-Index Routing Agent=0.011 ))|CATORT=0.104(CATRT=0.104(CATRT-Journal Agent=0.104)))|QDM=0.010;SRV=ATLHQMPHSMX1.eusc.europa.eu:TOTAL-DEL=0.060|SMR=0.006(SMRDI=0.005)|SDD=0.053(SDDSPCR=0.003(SDDCC=0.003)|SDDSPCS=0.002(SDDOS=0.002)|SDDPM=0.019(SDDPM-Conversations Processing Agent=0.012|SDDPM-Mailbox Rules Agent=0.004)|SDDSCMG=0.007(SDDCMM=0.002)|SDDCM=0.001|SDDSDMG=0.017(SDDR=0.017)|X-SDDS=0.011),Originating,,192.168.X.X,192.168.X.X,"S:IncludeInSla=True;S:MailboxDatabaseGuid=d3cbc250-34d2-4a36-8f6e-dab3d1248894;S:Mailboxes=ce6cae16-5bd9-4b7d-a1c4-9ae851224466;S:StoreObjectIds=AAAAAFjvGJqmWmRHocS0e5d51KAHAHn/uaFmuTFBgJ5aRTROcxAABSlL0VcAANwUEnI+lypImRLmR1/oEQoAA2WHe9sAAA==;S:FromEntity=Hosted;S:ToEntity=Hosted;S:P2RecipStat=0,003/1;S:MsgRecipCount=1;S:SubRecipCount=1;S:DeliveryLatency=0.571;S:AttachCount=1;S:E2ELatency=0.572;S:DeliveryPriority=Normal;S:AccountForest=xxx.yyyy.x",Email,a0cd35de-8a46-490d-ec84-08db577e4322,15.01.2507.021 what could be the reason why it does not get parsed correctly? Cheers   ... View more