yes he has.. I have cross checked it.. Also I re-ran chown command as well. ... View more

2) you are OK, if you keep everything in plain text - but once the splunk is restarted, it will encrypt the passwords automatically. ... View more

Hi naveencardinalhealth, Thanks. I havent seen any documentation within the splunk docs. For SH Cluster, I do agree with you (https://docs.splunk.com/Documentation/Splunk/latest/Security/Deploysecurepasswordsacrossmultipleservers) but for indexer i havent see any documentation. ... View more

It is as part of one of our performance requirement for the rare searches. As the splunk document says, Rare search ** - Similar to a super-sparse search, but receives assistance from bloom filters, which help eliminate index buckets that do not match the search request. Rare searches return results anywhere from 20 to 100 times faster than does a super-sparse search. ** From 10 to 50 index buckets per second. I/O bound ... View more

I can give you some high level approach we have used. We did only the Functionality testing Platform Connectivity - Use ssh -v -p inorder to test the connectivity Deployment server connectivity to Heavy FWD and Universal FWD (for UF, we have used few Windows and *nix machines Connectivity between Indexers, SH and FWD's Connectivity between Indexers and CM Connectivity between Deployer and SH Clusters Connectivity between staging server and Deployer Connectivity between Indexers and License Master Role based access: Check whether the users has permission (say, Network team can only access network indexes and they dont have admin access etc) Integration: LDAP connectivity Service now connectivity Ticketing system connectivity to check whether the tickets are automatically raised for the alerts DB connectivity Qualys API connectivity Cyber Threat Intelligence connectivity Data Management: Cold storage on Indexers - check whether the indexes are moved from warm to cold storage Data Collection capability A big piece of test work - Based on different sourcetypes whether the index time and search time extractions are done properly. Note: you can do performance testing, UAT /OAT testing etc. ... View more

Thanks Rich for your search. This search helped me in reducing the time in doing the testing.. ... View more

HI Welch, Thanks for the answer. There were 2 issues MAX_TIMESTAMP_LOOKAHEAD [source::...mail] - i have put only 2 dots in my props.conf instead of 3. ... View more

hooray it worked.. thanks a lot Woodcock.. ... View more

HI Woodcock, I hope this helps. Please let me know, if you need any further information. 2017-02-16T08:30:25+00:00 abc-f5-01 crit dcc[12345]:0131000 [secsv] Request violations: HTTP protocol compliance failed. HTTP protocol compliance sub violations:N/A. Virus name:N/A. Support id: 1235398573867863879, source ip:10.50.20.20, xff, ip 10.228.200.1, source port: 56753, destination ip: 10.228.200.1, destination port:80, route_domain:0, HTTP classifer: /Common/mso-appfarm-MRP, scheme HTTP, geographic locations: request:,session_id:<340586286825705c> Output of the alert: Host- abc-f5-01 PAN - 340586286825705 IIN_issue - American Express 2017-02-16T09:30:25+00:00 abc-f5-01 crit dcc[5667]:0131078 [secsv] Request violations: HTTP protocol compliance failed. HTTP protocol compliance sub violations:N/A. Virus name:N/A. Support id: 8967869087298456298, source ip:10.50.20.20, xff, ip 10.228.200.1, source port: 56729, destination ip: 10.228.200.1, destination port:80, route_domain:0, HTTP classifer: /Common/mso-appfarm-MRP, scheme HTTP, geographic locations: request:,session_id:<5178081683798099> Host- abc-f5-01 PAN - 5178081683798099 IIN_issue - Master Card ... View more

Thanks DalJeanis: Valid point, but it was initially turned down by Security team. Forgot the actual reason. That's why I am going through this painful process. ... View more

thanks a lot for your prompt response. I will explain in detail. We are using luhn_lookup command to check whether any given logs has 16 digit credit card number (16 digits must be in sequence, same like 16 digit long number on our credit card). To check a 16 digit number is a credit card number or not use this URL (https://planetcalc.com/2465/) For eg: if an URL has a 16 digit number and if it matches the credit card number (through luhn_lookup algorithm), it will create an alert. It is bit weird as it generates 100's of false positive alerts a day. It is not just restricted to URL, session_ id/support id in a log, kernel error. Currently, I am interested in session_id in the log which are generated by f5 devices. session_id will be generated in 4 types: 1. starts with an alphabet then only digits like - a68789758978678 2. starts and ends with alphabets and digits in the middle - h8676589765897608976c 3. starts with digits and ends with alphabet - 979679067896078609784a 4. only digits - 4586749867496749409 From the above 4 types, if the luhn lookup finds a match with a credit card number then it triggers an alert. Our business units agreed that this is a false alert and as a team we have to make sure that on the F5 logs, if the alert is triggered on session_id we have to suppress the alert. Apart from the session_id field, if it triggers the alert, then we need to display it as a notable event. As an example: 2017-02-16T08:30:25+00:00 abc-f5-01 crit dcc[12345]:0131000 [secsv] Request violations: HTTP protocol compliance failed........ HTTP1.1\r\n\Content-type:text:xml; charset=uf.,username:, session_id:<340586286825705c> luhn_lookup matches the above session_id,( if you copy paste these numbers to the planetcalc.com link it says, the issuer is American Express.) But we know this is a session_id and not related to any credit card number. So its a false positive. One more session_id:<5178081683798099> - this is also a false positive. if i get a session id:<0123456789101112> - this wont trigger any alert as it is not a credit card number as per the luhn_lookup Hope this helps. ... View more

Hi bbingham, thanks for your prompt response. My actual search is this - NOT sourcetype=stash | get_integer_seq | lookup luhn_lookup _raw OUTPUTNEW pii,pii_clean | eval pii_length=len(pii_clean) | lookup iin_lookup iin as pii_clean,length as pii_length OUTPUTNEW iin_issuer | search iin_issuer=* | get_event_id | rename event_id as orig_event_id | eval orig_raw=_raw | fields - _raw | fields + orig_event_id,orig_raw,host,pii,iin_issuer | eval pii_hash=sha1(pii) | eval orig_time=_time |rex field=orig_raw "\sessiond_id:\s<[a-z]?(?CARD\d+) [a-z]?>" | eval falsepositive = if (PAN == CARD, "0" ,"1") | where falsepositive = "0" rename pii as PAN, orig_raw AS "Event log" .. there was a typo in the earlier Alerts which are generating false positive, 2017-02-16T08:30:25+00:00 abc-f5-01 crit dcc[12345]................... session_id: 2017-02-16T09:30:25+00:00 abc-f5-01 crit dcc[12345]................... session_id: 2017-02-16T10:30:25+00:00 abc-f5-01 crit dcc[12345]................... session_id:<745648609869456bc> 2017-02-16T11:30:25+00:00 abc-f5-01 crit dcc[12345]................... session_id:<765756896789367389> As per your reply i tried this - correct me if I am wrong - rex field=orig_raw "\sessiond_id:\s<(?[a-z]?)(?\d+)(?[a-z]?>" | eval CARD="char1,CARD,char2" | makemv CARD delim="" allowempty=t | --- here i am confused, which one i need to use to compare against. ... View more

Hi Balaji, whether u were able to sort this out? I am having similar issue. Also, whether your Enterprise Security is installed on Search Head cluster? ... View more

Thanks botkindl ... View more

Thanks Chris ... View more

I did see this link.. but I am confused with Super-parse and rare search. If I have 10 million lines, what will be the occurrences? ... View more