All Apps and Add-ons

Proofpoint - ET Splunk TA: Request for developers from Splunk Cloud Support

wryanthomas
Contributor

Dear 'Proofpoint Splunk Integrators', developers of the Proofpoint - ET Splunk TA.

I've been working with Splunk Cloud Support to try to get this TA working for our Security team.

Challenge:
Scripted inputs are not currently allowed on Splunk Cloud Search Heads.
This TA uses scripted inputs to populate the ET lookups directly. Search Heads are where the lookups are needed.
When scripted inputs are not allowed, the initial view of the app does not prompt users for access code (for good reason).
When populating lookups on a heavy forwarder, there is no clear / easy path to getting the lookups (or the ET data) available on the Search Head.

Splunk Support has encouraged me to give feedback / make requests:
* at minimum, provide documentation to acknowledge this challenge and perhaps some guidance on how to work around it.
* update to include a built-in mechanism to allow people in this scenario to get the ET data from a heavy forwarder to a search head.

0 Karma

bwoodberg_proof
New Member

Hi Ryan,

I'm the product manager for the Splunk TA at Proofpoint. This will require an enhancement of the TA. I'm going to put it into an internal enhancement request for consideration of our next update of the app.

Best Regards,
Brad Woodberg

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...