Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About archme
archme
Explorer
Member since:
03-29-2018
02-19-2021
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 03-29-2018 |
Activity Feed
- Tagged Splunk UBA Installation on All Apps and Add-ons. 02-05-2021 01:28 AM
- Tagged Splunk UBA Installation on All Apps and Add-ons. 02-05-2021 01:28 AM
- Posted Splunk UBA Installation on All Apps and Add-ons. 02-05-2021 01:21 AM
- Got Karma for Selective Filtered Indexing and Forwarding to 3rd party syslog. 06-05-2020 12:50 AM
- Posted Forward filtered logs to indexer and full logs to third party syslog server on Getting Data In. 01-11-2020 03:25 AM
- Tagged Forward filtered logs to indexer and full logs to third party syslog server on Getting Data In. 01-11-2020 03:25 AM
- Tagged Forward filtered logs to indexer and full logs to third party syslog server on Getting Data In. 01-11-2020 03:25 AM
- Tagged Forward filtered logs to indexer and full logs to third party syslog server on Getting Data In. 01-11-2020 03:25 AM
- Tagged Forward filtered logs to indexer and full logs to third party syslog server on Getting Data In. 01-11-2020 03:25 AM
- Posted Re: Selective Filtered Indexing and Forwarding to 3rd party syslog on Getting Data In. 01-08-2020 04:04 AM
- Posted Selective Filtered Indexing and Forwarding to 3rd party syslog on Getting Data In. 01-07-2020 07:40 AM
- Tagged Selective Filtered Indexing and Forwarding to 3rd party syslog on Getting Data In. 01-07-2020 07:40 AM
- Tagged Selective Filtered Indexing and Forwarding to 3rd party syslog on Getting Data In. 01-07-2020 07:40 AM
- Tagged Selective Filtered Indexing and Forwarding to 3rd party syslog on Getting Data In. 01-07-2020 07:40 AM
- Tagged Selective Filtered Indexing and Forwarding to 3rd party syslog on Getting Data In. 01-07-2020 07:40 AM
- Tagged Selective Filtered Indexing and Forwarding to 3rd party syslog on Getting Data In. 01-07-2020 07:40 AM
- Posted How does splunk enterprise security asset lookup handle lookups of additional details for incidents with dynamic ip ? on Splunk Enterprise Security. 12-27-2019 04:43 AM
- Tagged How does splunk enterprise security asset lookup handle lookups of additional details for incidents with dynamic ip ? on Splunk Enterprise Security. 12-27-2019 04:43 AM
- Tagged How does splunk enterprise security asset lookup handle lookups of additional details for incidents with dynamic ip ? on Splunk Enterprise Security. 12-27-2019 04:43 AM
- Tagged How does splunk enterprise security asset lookup handle lookups of additional details for incidents with dynamic ip ? on Splunk Enterprise Security. 12-27-2019 04:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
02-05-2021
01:21 AM
Hi I am trying to install the latest version of baremetal uba on rhel 7.8. I have followed the requirements and steps mentioned in splunk docs. When I ran the pre check script, i noticed the following: /var/log symlinks: 13 <= expecting 14; verify missing link ... 'containers' symlink not found It looks like the containers folder was not created in the /var/log folder it also showed me this: /var/log perm/owner: lrwxrwxrwx. 1 root root 23 Feb 3 12:58 /var/log/kafka -> /var/vcap/sys/log/kafka <= issue with one (or more) log sub-directories The owner for this should be caspida:caspida correct? Also showed me this: interface: '<%' <== system.network.interface value in /etc/caspida/local/conf/uba-site.properties does not match 'eth0' Splunk docs mentioned If the network interface is not the default eth0, edit configuration file /etc/caspida/local/conf/uba-site.properties and add the following entry with the corresponding interface: system.network.interface=<interface> My nic is already eth0 Any assistance will be appreciated.. Thanks
... View more
Labels
- Labels:
-
installation
-
troubleshooting
01-11-2020
03:25 AM
Hello,
I am currently forwarding logs from uf to HF to idx.
What I am trying to achieve is drop windows event with the event code 4674 for example from being sent to idx. At the same time, forward all the logs including the events with the event code 4674 to a 3rd party syslog server from the HF.
While configuring the HF, I found:
1) there is a delay in sending the logs to syslog server. I noticed that I received it roughly 15 minutes after the event time.
2) I configured the event code 4674 to send to nullqueue. By doing so, it dropped the event from being sent to idx. However, it is also not forwarding this event to the 3rd party syslog server. I need it only drop the events from being sent to idx. It has to send this event to the syslog server.
Not sure what is wrong..hope someone can advise.
Below is my outputs.conf setting:
[tcpout]
defaultGroup = primary_indexers
[syslog]
defaultGroup = EverythingtoSSB
[syslog:EverythingtoSSB]
#sendCookedData=false
server=1.2.3.4:514
type=udp
maxEventSize=5096
Below is props.conf:
[WinEventLog:Security]
TRANSFORMS-set=wineventlog-setnull,routeAlltoSSB
Below is transforms.conf
[routeAlltoSSB]
REGEX=(.)
DEST_KEY=_SYSLOG_ROUTING
FORMAT=EverythingtoSSB
[wineventlog-setnull]
REGEX=(?m)^EventCode=(4674)
DEST_KEY = queue
FORMAT = nullQueue
... View more
01-08-2020
04:04 AM
Hi
I am thinking of putting the following on the HF
outputs.conf
[tcpout]
defaultGroup = primary_indexers
### this setting will send all the logs to third party syslog server. This setting seems to be working fine.
[syslog]
defaultGroup = EverythingtoSyslog
[syslog:EverythingtoSyslog]
#sendCookedData=false
server=1.2.3.4:514
type=udp
maxEventSize=5096
props.conf
# For wineventlog sourcetype , i tried to put the following plus the transforms below..but it did not drop the event.
[wineventlog]
TRANSFORMS-set=wineventlog-setnull,wineventlog-setparsing
transforms.conf
### this following setting should drop events with the eventcode 4624 for example in wineventlog from being send to indexer. The rest of the logs should be sent to primary_indexers. This should not conflict with linux_secure or cisco filtering
# For wineventlog sourcetype , i tried to put the following plus the props above..but it did not drop the event.
[wineventlog-setparsing]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue
[wineventlog-setnull]
REGEX=EventCode=(4624)
DEST_KEY = queue
FORMAT = nullQueue
### the following setting should Only send events with "ssh" keyword for example in linux_secure to the indexer. Other events in linux_secure sourcetype should not be sent to the indexer. This should not conflict with the wineventlog or cisco filtering.
not sure what to put here
### This should send all cisco:asa events to the indexer. This should not conflict with the above 2 settings.
not sure what to put here
... View more
01-07-2020
07:40 AM
1 Karma
Hello,
Our setup is as follows:
Windows/Unix UF -> HF -> IDX Clusters
Currently we are sending everything to IDX cluster and 1 copy of the logs to a 3rd party syslog server from the HF.
What we are trying to achieve is to send everything to the 3rd party syslog server and only send filtered logs to the idx clusters.
Given the scenario of the following sourcetype:
a) wineventlog
b) linux_secure
c) cisco:asa
I am trying to figure out how we can :
a) Send everything to the 3rd party syslog
b) Drop events with the eventcode 4624 for example in wineventlog from being send to indexer.
c) Only send events with "ssh" keyword for example in linux_secure to the indexer. Other events in linux_secure sourcetype should not be sent to the indexer.
d) send all cisco:asa events to the indexer.
... View more
12-27-2019
04:43 AM
We are current running the seckit for aws asset runs schedully to created aws assets lookup table.
Now, for the elb, the IP changes automatically after sometime..for example 192.168.1.70 is mapped to host1.fqdn today..
And incident happens for 192.168.1.70 ip, and it is able to show host1.fqdn as the hostname/fqdn of that IP under incident review additional details section.
Tomorrow, 192.168.2.90 is used for the host1.fqdn elb. If I go and check yesterday's incident for 192.168.1.70 IP, will it still show host1.fqdn as the hostname/fqdn or it will not show any hostname/fqdn as that IP is not mapped to any host/fqdn anymore.
How can we retain the original hostname / original mapping fields for an incident in the additional fields in the incident review section for this kind of scenario?
... View more
06-12-2019
09:37 PM
i am using the following for my agt_risk extraction:
[field_extraction_for_agt_risk]
REGEX =(?i)(?:[[sep_file_prefix]]),\s*(?[[sep_file_field]]),\s*(?:IP\sAddress:\s*(?[[sep_file_field]]))?,\s*(?:Computer\sname:\s*(?[[sep_file_field]]))?,\s*(?:Source:\s*(?[[sep_file_field]]))?,\s*(?:Risk\sname:\s*(?[[sep_file_field]]))?,\s*(?:Occurrences:\s*(?[[sep_file_field]]))?,\s*(?[[sep_file_field]]),\s*(?[[sep_file_field]]),\s*(?:Actual\saction:\s*(?[[sep_file_field]]))?,\s*(?:Requested\saction:\s*(?[[sep_file_field]]))?,\s*(?:Secondary\saction:\s*(?[[sep_file_field]]))?,\s*(?:Event\stime:\s*(?[[sep_file_field]]))?,\s*(?:Inserted:\s*(?[[sep_file_field]]))?,\s*(?:End:\s*(?[[sep_file_field]]))?,\s*(?:Last\supdate\stime:\s*(?[[sep_file_field]]))?,\s*(?:Domain:\s*(?[[sep_file_field]]))?,\s*(?:Group:\s*(?[[sep_file_field]]))?,\s*(?:Server:\s*(?[[sep_file_field]]))?,\s*(?[[sep_file_field]]),\s*(?:Source\scomputer:\s*(?[[sep_file_field]]))?,\s*(?:Source\sIP:\s*(?[[sep_file_field]]))?,\s*(?:Disposition:\s*(?[[sep_file_field]]))?,\s*(?:Download\ssite:\s*(?[[sep_file_field]]))?,\s*(?:Web\sdomain:\s*(?[[sep_file_field]]))?,\s*(?:Downloaded\sby:\s*(?[[sep_file_field]]))?,\s*(?:Prevalence:\s*(?[[sep_file_field]]))?,\s*(?:Confidence:\s*(?[[sep_file_field]]))?,\s*(?:URL\sTracking\sStatus:\s*(?[[sep_file_field]]))?,\s*(?:First\sseen:\s*(?[[sep_file_field]]))?,\s*(?:Sensitivity:\s*(?[[sep_file_field]]))?,\s*(?[[sep_file_field]]),\s*(?:Application\shash:\s*(?[[sep_file_field]]))?,\s*(?:Hash\stype:\s*(?[[sep_file_field]]))?,\s*(?:Company\sname:\s*(?.))?,\s(?:Application\sname:\s(?[[sep_file_field]]))?,\s*(?:Application\sversion:\s*(?P[[sep_file_field]]))?,\s*(?:Application\stype:\s*(?[[sep_file_field]]))?,\s*(?:File\ssize\s(bytes):\s*(?[[sep_file_field]]))?,\s*(?:Category\sset:\s*(?[[sep_file_field]]))?,\s*(?:Category\stype:\s*(?[[sep_file_field]]))?,?\s*(?:Location:\s*(?[[sep_file_field]]))?,\s*(?:Intensive\sProtection\sLevel:\s*(?[[sep_file_field]]))?,?\s*(?:Certificate\sissuer:\s*(?[[sep_file_field]]))?,?\s*(?:Certificate\ssigner:\s*(?[[sep_file_field]]))?,?\s*(?:Certificate\sthumbprint:\s*(?[[sep_file_field]]))?,?\s*(?:Signing\stimestamp:\s*(?[[sep_file_field]]))?,?\s*(?:Certificate\sserial\snumber:\s*(?[[sep_file_field]]))?
... View more
06-11-2019
07:03 PM
i see...
in my case, if the 5 switches are connected to a master core switch, then span porting at the core switch only should be sufficient right?
also, instead of using UF as the collection node, can we use HF as collection node?
thanks
... View more
05-21-2019
03:39 AM
Hi
We hace around 5 Cisco switch that we wanted to capture traffic from.
Questions :
1) can we install splunk stream on a virtual host in esxi and span port the switch to the nic in the virtual host? Or does the switch need to span port to the physical nic from the esxi machine?
2) since we have 5 Cisco switch that we will be capturing from, does it mean that we need to enable 5 nic in the virtual host and span port the switches to it? Or does the esxi host need to have 5 mic?
I only have experience in capturing traffic from 1 device span port to a physical host nic.
Your guidance will be much appreciated.
Thanks
... View more
- Tags:
- Splunk Stream
06-11-2018
05:31 AM
Hi
I wanted to get some opinion in these 2 scenarios:
Scenario 1:
A collection of UF + Network devices sending via syslog -> Consolidated at 1 HF -> IDX
Scenario 2:
A collection of UF sends directly to IDX
Network devices sending via syslog -> Consolidated at 1 Syslog server with UF installed -> IDX
In Scenario 1, if there is a connectivity issue between HF and IDX, will there be data loss? I understand we can enable persistent queues as well which will store the logs temporarily in memory. This means the HF will require high memory to cater for data loss incase of network failure between HF and IDX?
In scenario 2, there is storage space allocated inside the syslog server which can cater for storing the logs temporarily in the event of data loss. However, in this scenario, how will the events from checkpoint/dbconnect be catered for? It still requires HF and will fall under scenario 1? Multiple firewall rules need to be allowed from all the UF installed servers to the IDX. The consolidation of logs from all the UF will not happen in this scenario right (incase of collecting from remote sites)?
Question outside of scenario 1 and scenario 2:
Can HF be installed on the syslog server and be used to collect the logs stored by the syslog server and push it to idx? What happens if there is network failure? will the HF have a marker that says where it stopped collecting the logs from and will resume accordingly when the connectivity comes back up? will there be data loss?
Thanks in advance
... View more
