- Splunk Answers
- :
- Splunk Premium Solutions
- :
- Security Premium Solutions
- :
- Splunk Enterprise Security
- :
- Is CCURE add-on compatible with CCURE 9000
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is CCURE add-on compatible with CCURE 9000
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@richardphung:
Would you mind sharing your DB query? I'm looking to set this up and am curious to know what you used...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm also interested in the query if anyone has something to start with.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We use this app with CCURE9000.
It kind of depends on your DB Query whether the built-in extracts are going to work for you,... but it isn't hard to customize.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey sorry for the late response,
I'm not too sure if it will or not. When it was created i built it off of a different version for certain. IF the log syntax is similar enough to that of the Redacted Log Sample below, I'd say you're in good shape for it to work.
Redacted Log Sample
2018-12-20 13:29:58.000, MessageUTC="2018-12-20 18:29:58.0", MessageType="CardAdmitted", PrimaryObjectName="liechtenstein, ulrich", PrimaryObjectIdentity="AA11A11A-AA11-11AA-A1A1-AAAAAA111111", SecondaryObjectName="potentially the name of entrance area", SecondaryObjectIdentity="B2B2B2B2-BB22-22BB-B2B2-BBBBBB22222", XmlMessage="InDirection12345AdmitAdmitliechtenstein, ulrichpotentially the name of entrance area"
In the event your logs differ. You could send over redacted log samples of the 9000 product and i could update the add-on and get it out with the new release.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
did you try it?
Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...
Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...
Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...
