All Apps and Add-ons

Modsecurity not working

dolfantimmy
Path Finder

I've read the other posts about this issue but none seem relative. I have a single splunk instance installed on my local PC. I have installed the modsecurity app and related apps. I have added a local file input for modsec_audit.log. I can see the data when querying from the search tool, but I get no data from within the modsecurity app.

When creating the data input, modsec_audit was not available in the list for sourcetypes. Attempting to create it told me that it already existed. So I created the sourcetype modsec_audit2, and modified the modsecurity macros.conf to reflect this. The input is directed to main db so that is not the issue.

Any assistance will be greatly appreciated.

Tags (2)
0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

Hello there...

First, regarding the sourcetype:
In order for a sourcetype to show up in the dropdown list in the inputs form the sourcetype definition must have a line like this:
pulldown_type = true
the [modsec_audit] definition that comes with the app does not.
So you could have selected "manual" and just typed it in.

however, as it explains in the documentation, it's perfectly legitimate to use another name. However, from what you've described, you now have a stanza that is called [modsec_audit2]
be sure it contains the same entries as the [modsec_audit] definition found in
$SPLUNK_HOME/etc/apps/modsecurity/default/props.conf
as there are some essential field extractions in there...

As for the dashboards not populating even though the index is populated...

Best thing to do is to take a look at the searches that the dashboards are running.
One of my customers had the same problem, and it turned out that he simply wasn't logging any of the fields that the app author thought were interesting. So the dashboards had nothing to show...

The dashboards are written with Advanced XML but the searches are all Saved Searches.
So you can run them independently. You can see the code for the Dashboards here:
$SPLUNK_HOME/etc/apps/modsecurity/default/data/ui/views/

modsecurity_dashboard.xml for instance runs the following saved searches
that look like this: <savedSearch>Modsec denied by ip</savedSearch>


modsec_index modsec_src |stats dc(msg) as Messages by clientip |sort - Messages |head 10

check out savedsearches.conf and run them... see what you can see.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...