About rwang_splunk

rwang_splunk · ‎08-11-2016

Hi Madc0w You are correct. I think it is a bug in our add-on. We'll fix the issue in the next release. You can apply the code below in nessus_data_collector.py for a quick fix. line 12: import splunktalib.common.util as util line 140: change if self.config.get("index_events_for_unsuccessful_scans", True): to if util.is_true(self.config.get("index_events_for_unsuccessful_scans", True)):

rwang_splunk · ‎08-09-2016

Hi again Cudgel. Thanks for your considerations. I'll pass the requirement to PMs.

rwang_splunk · ‎08-08-2016

Hi Cudgel See http://docs.splunk.com/Documentation/AddOns/released/Nessus/Description I think Splunk Add-on for Tenable can support Security Center 5.3.x. But it doesn't support Security Center 5.4 since the set-cookie format is changed in 5.4.

rwang_splunk · ‎08-07-2016

Hi Kent The Splunk add-on for Nessus now only supports to get plug-in and scan data. You can't get certification information using this add-on. See http://docs.splunk.com/Documentation/AddOns/released/Nessus/Description

rwang_splunk · ‎08-04-2016

Hi Coltwanger You have to apply for the role in security center to be able to get data into Splunk. See http://docs.splunk.com/Documentation/AddOns/released/Nessus/Hardwareandsoftwarerequirements for more information.

rwang_splunk · ‎07-26-2016

I'm glad it's working. Renee

rwang_splunk · ‎07-25-2016

Hi Tony Not sure. Are you using Nessus 5.x? what are the fields you want to extract? you may have to update the script in the file to extract new fields.

rwang_splunk · ‎07-25-2016

Hi msketteran Try to use the following command in console to check whether it is a problem of the network. curl -k -H "Accept: application/json" -H "Content-Type: application/json" -H "X-ApiKeys: accessKey=YOUR ACCESSKEY; secretKey=YOUR SECRET KEY" -X GET https://xxx.xxx.xxx.xxx:8834/scans/194 If you cannot connect the network successfully, try to check the network configuration. Otherwise, it might be a bug related to this add-on, you can file a customer ticket and we can have further investigation. thanks.

rwang_splunk · ‎07-21-2016

Hi gharrison Can you please explain more about 'getting the incomplete scan data', what does the 'incomplete data' mean here. I think if you set index_events_for_unsuccessful_scans=0, the result of the unsuccessful scan won't be fetched after your configuration. If it is not the case, you can file a support ticket and we can have further investigation.

rwang_splunk · ‎07-21-2016

Hi bashpd What version of Splunk add-on for Okta you are using? How did you configure you data input? via UI or inputs.conf? Try using UI to configure the inputs again and eliminate the space in your input name. let me know if it still doesn't work.

rwang_splunk · ‎07-20-2016

Hi Butzowj Can you explain more about production okra data and non-production data please? I am guessing you're using multiple domains and probably need to configure access from your account to those domains (Okta side).

rwang_splunk · ‎07-18-2016

Hi butzowj The sourcetype okta:user is designed to retrieve all user data from Okta system on a certain interval time. It will pull the same data from the Okta system if the user information does not change. I think you can either disable the inputs after pulling the data, and enable it whenever you want to, or set a longer interval time to prevent frequent data duplication.

rwang_splunk · ‎06-01-2016

Correct. Save as a dashboard first, then edit the source.

rwang_splunk · ‎05-31-2016

Hi Roopesh the xml is not in any of the files or directories of splunk installation file. If you want to edit it, you have to save your spl as a dashboard, then go to 'edit source' to add the charting.data.count in the simple xml code. you can set it to 0 if you want to retrieve all data. Renee

rwang_splunk · ‎05-30-2016

Hi roopeshetty I think these two links below can help you. http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartDisplayissues http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/ChartConfigurationReference#General_chart_properties

Posts	15
Solutions	6
Karma Given	0
Karma Received	11
Member Since	‎05-30-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: Why is the Splunk Add-on for Nessus indexing r...

Re: The Splunk Add-on for Nessus config job runs, ...

Re: The Splunk Add-on for Nessus config job runs, ...

Re: Splunk Add-on for Nessus; How to get certifica...

Re: Splunk Add-on for Nessus: What SecurityCenter ...

Re: Splunk Add-On for Okta: How to troubleshoot er...

Re: Extract additional fields using nessus2splunk....

Re: Why am I not retrieving scan data, only plugin...

Re: Why is the Splunk Add-on for Nessus indexing r...

Re: Splunk Add-On for Okta: How to troubleshoot er...

Re: Splunk App and Add-on for Okta: Why are we not...

Re: How to get the Splunk App and Add-on for Okta ...

Re: unable to see all the events in visualisation

Re: unable to see all the events in visualisation

Re: unable to see all the events in visualisation