Hi,
I am trying get the ThreadHunting app (https://splunkbase.splunk.com/app/4305/) up and running.
It references a TGZ file for various CSV lookup templates, but zjr TGZ file misses four of the lookup files and I have not found any documentation for it so far that would explain which fields are needed in those files and where they come from.
(I did create files with headings that I gleaned from transforms.conf, but I assume that is not sufficient).
The missing ones are:
threathunting_dns_whitelist.csv
threathunting_file_create_whitelist.csv
threathunting_pipe_whitelist.csv
threathunting_wmi_whitelist.csv
Does anyone have working templates for those files?
Additionally, I see a pan_threat macro referencing a pan_logs index which I have no clue about.
Unfortunately the wiki is not that good in explaining the setup.
And on top of that there is a conflig for the eventcode lookup with the sysmon TA which is a prerequiste for this App?
Thanks for any pointers
afx
