Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About simonsigre
simonsigre
Path Finder
Member since:
04-19-2018
01-30-2024
Community Statistics
| Posts | 18 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 27 |
| Member Since | 04-19-2018 |
Activity Feed
- Posted Confirming 'Wiz Add-on For Splunk' TA is Vendor Produced (#6676) on Splunk Dev. 01-30-2024 02:02 PM
- Got Karma for Microsoft Azure Add on for Splunk 3.1.1 - authentication_method. 09-24-2021 10:43 AM
- Got Karma for Microsoft Azure Add on for Splunk 3.1.1 - authentication_method. 06-28-2021 07:34 PM
- Got Karma for Microsoft Azure Add on for Splunk 3.1.1 - authentication_method. 06-28-2021 04:40 PM
- Got Karma for Microsoft Azure Add on for Splunk 3.1.1 - authentication_method. 06-28-2021 04:24 PM
- Got Karma for Microsoft Azure Add on for Splunk 3.1.1 - authentication_method. 06-28-2021 04:20 PM
- Got Karma for Microsoft Azure Add on for Splunk 3.1.1 - authentication_method. 06-28-2021 04:16 PM
- Got Karma for Microsoft Azure Add on for Splunk 3.1.1 - authentication_method. 06-28-2021 04:13 PM
- Got Karma for Microsoft Azure Add on for Splunk 3.1.1 - authentication_method. 06-28-2021 04:07 PM
- Got Karma for Microsoft Azure Add on for Splunk 3.1.1 - authentication_method. 06-28-2021 04:06 PM
- Got Karma for Microsoft Azure Add on for Splunk 3.1.1 - authentication_method. 06-28-2021 04:06 PM
- Posted Microsoft Azure Add on for Splunk 3.1.1 - authentication_method on All Apps and Add-ons. 06-28-2021 03:57 PM
- Tagged Microsoft Azure Add on for Splunk 3.1.1 - authentication_method on All Apps and Add-ons. 06-28-2021 03:57 PM
- Tagged Microsoft Azure Add on for Splunk 3.1.1 - authentication_method on All Apps and Add-ons. 06-28-2021 03:57 PM
- Tagged Microsoft Azure Add on for Splunk 3.1.1 - authentication_method on All Apps and Add-ons. 06-28-2021 03:57 PM
- Got Karma for TA Announcement - CCX Unified Splunk Add-on for Trend Micro. 11-30-2020 03:45 PM
- Got Karma for TA Announcement - CCX Unified Splunk Add-on for Trend Micro. 11-30-2020 01:47 PM
- Got Karma for TA Announcement - CCX Unified Splunk Add-on for Trend Micro. 11-30-2020 01:33 PM
- Got Karma for TA Announcement - CCX Unified Splunk Add-on for Trend Micro. 11-30-2020 01:33 PM
- Got Karma for TA Announcement - CCX Unified Splunk Add-on for Trend Micro. 11-30-2020 01:31 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 10 | |||
| 5 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 6 |
01-30-2024
02:02 PM
I am sure its fine, but this TA seems a little off (logo and the 'Built By') .. given who Wiz are, what they do and their high profile nature recently of disrupting some bad-guys .. I am keen for others views on this "Built by product-integrations product-integrations" .. strange.. and the logo seems pixilated. Our team has recently had some "luck" in getting things vetted that really shouldn't be (and yes we reported) .. so simply saying 'its passed App Vetting" isn't enough for us.
... View more
06-28-2021
03:57 PM
10 Karma
It looks to be that in version 3.1.1 the defaults for AAD Sign Ins swaps away from BETA --> 1.0 which looks to not be providing authentication_method (MFA/2FA) information. This default change in behaviour can be seen in this file 'input_module_MS_AAD_signins.py' BEFORE: url = graph_base_url + "/beta/auditLogs/signIns?$orderby=createdDateTime&$filter=createdDateTime+ge+%s+and+createdDateTime+le+%s" % (query_date, end_date.strftime('%Y-%m-%dT%H:%M:%S.%fZ')) AFTER: url = graph_base_url + "/%s/auditLogs/signIns?$orderby=createdDateTime&$filter=createdDateTime+ge+%s+and+createdDateTime+le+%s" % (endpoint, query_date, end_date.strftime('%Y-%m-%dT%H:%M:%S.%fZ')) For anyone who really needs/wants authentication_method information I strongly encourage you to back to your INPUTS and change the dropdown back to BETA. These seem to have been dropped by MS in v1 . unless BETA is ahead .. in which case they will be and all that is required is to change the INPUT
... View more
Labels
- Labels:
-
troubleshooting
11-30-2020
01:26 PM
5 Karma
Just an announcement post to let people know we have published our TA to the community for Trend Micro Deep Security and ApexOne. https://splunkbase.splunk.com/app/5349/ This TA falls under our Unified line of TAs and will support as many Trend Micro products as we can. This TA is actually CIM compliant (vs the usual tick box) and built on large datasets. Fully compatible with Splunk Enterprise and Splunk Cloud, built by an Ops team for Ops teams.
... View more
Labels
- Labels:
-
development
02-22-2020
04:42 PM
I note the author details reference a version that does not yet exist..
(https://splunkbase.splunk.com/apps/#/author/mimecast_4_splunk_integration) as there are number of known CIM compatibility and field extraction issues we all hope that Mimecast would consider making this a public code project so members of the community to contribute directly.
... View more
07-10-2019
04:55 PM
We know.. we worked with MimeCast to fix it for them 🙂
... View more
06-25-2019
04:17 PM
This appears to still be the case for the latest version... tags are applied correctly but the action field is not populated from the CIM list.
... View more
04-25-2019
07:08 PM
It appears the latest (3.1.1) version of the Splunk TA has fields extracted including the surrounding speech marks.
e.g.
"Attempt Greylisted"
"Policy level Anti-Spoofing applied"
"SPF Sender Invalid"
"Failed Known address verification"
"[MCSpamSignature.r.s.195.344]"
"[MCSpamSignature.r.s.94.219]"
..etc
This is the case for most fields.
... View more
04-25-2019
07:02 PM
JRamirezEnosys; I would seriously consider upgrading all components to 3.1.1 .. all versions prior to that are horribly flawed.
There are a few issues in 3.1.1 also but its worlds apart.
You will need to recreate your inputs also.
... View more
04-25-2019
06:59 PM
There are multiple issues with the TAs, with the upgrade to the latest version 3.1.1 you actually need to delete your inputs and recreate them otherwise you get errors such as
2019-04-25 22:40:22,691 ERROR pid=6897 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-mimecast-for-splunk/bin/ta_mimecast_for_splunk/modinput_wrapper/base_modinput.py", line 127, in stream_events
self.collect_events(ew)
File "/opt/splunk/etc/apps/TA-mimecast-for-splunk/bin/mimecast_ttp_url.py", line 84, in collect_events
input_module.collect_events(self, ew)
File "/opt/splunk/etc/apps/TA-mimecast-for-splunk/bin/input_module_mimecast_ttp_url.py", line 32, in collect_events
logs = api.fetch_ttp_url_logs()
File "/opt/splunk/etc/apps/TA-mimecast-for-splunk/bin/mimecast/api.py", line 121, in fetch_ttp_url_logs
return self.fetch_logs(LogTypes.TTPURL)
File "/opt/splunk/etc/apps/TA-mimecast-for-splunk/bin/mimecast/api.py", line 50, in fetch_logs
parsed_events = parser(helper=self.helper).parse(response.content)
File "/opt/splunk/etc/apps/TA-mimecast-for-splunk/bin/mimecast/parser/ttp_url.py", line 30, in parse
for click_log in data_json['data'][0]['clickLogs']:
IndexError: list index out of range
... View more
04-17-2019
05:52 PM
2 Karma
Yes it does. We have 12.1 running with supported customers with no issue
... View more
01-24-2019
01:28 PM
We are about to post an entirely new version of this app (under a new name etc due to some App Submission guidelines) .. the certification process should be completed <5 days all going well.
Please check this link over the next few days;
https://splunkbase.splunk.com/apps/#/search/enosys/
... View more
01-15-2019
04:47 PM
1 Karma
We are now maintaining this TA to ensure its vetted and continues to parse (https://splunkbase.splunk.com/app/4238/) .
We have a few updates happening over the next few days, so, please wait before downloading it .. but.. it is working well and vetted for cloud.
... View more
01-15-2019
04:47 PM
We are now maintaining this TA to ensure its vetted and continues to parse (https://splunkbase.splunk.com/app/4238/) .
We have a few updates happening over the next few days, so, please wait before downloading it .. but.. it is working well and vetted for cloud.
... View more
01-15-2019
04:46 PM
We are now maintaining this TA to ensure its vetted and continues to parse (https://splunkbase.splunk.com/app/4238/) .
We have a few updates happening over the next few days, so, please wait before downloading it .. but.. it is working well and vetted for cloud.
... View more
01-10-2019
04:20 PM
@shogan_splunk any updates on the GitHub access?
... View more
01-02-2019
07:49 PM
1 Karma
Our team is currently updating the field extraction for the existing Splunk Add-on for Check Point OPSEC LEA (https://splunkbase.splunk.com/app/3197/) v431 version to ensure as much of it is Splunk ES CIM compliant.
We will be doing our first push to https://github.com/enosysau/Splunk_TA_checkpoint-opseclea_Enosys in 24-48 hours and from that point we hope for Splunk to make their project available and we can merge the projects or the community as a whole can assist us in keeping this insync with each other.
We recognise that this is a Splunk project and recognise the effort/contribution made by them to maintain this to-date.
Keen for any thoughts/updates;
https://github.com/enosysau/Splunk_TA_checkpoint-opseclea_Enosys
... View more
11-20-2018
10:24 PM
Thanks @shogan_splunk appreciate the update and look forward to getting access to repo .
Also, props (not a Splunk joke) to forum handle.
... View more
10-17-2018
01:01 AM
6 Karma
I have noted events such as
index=* sourcetype=ActiveDirectory admonEventType="deleted" OR admonEventType="updated"
Does not have an eventtype set that applies the appropriate tags to have it comply with
https://docs.splunk.com/Documentation/CIM/4.11.0/User/ChangeAnalysis
Even though this is flagged as being CIM compliant, would be great if these where added, or, the project Git repo be made available as to allow contributions
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-30-2024
05:23 PM
|
