Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About DBuhler
DBuhler
Explorer
Member since:
06-15-2018
09-27-2021
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 06-15-2018 |
Activity Feed
- Got Karma for Re: How to create matching log with CIM "proxy" data model to see information in ES?. 09-14-2020 05:01 PM
- Posted Re: Veeam Backup Monitoring Using Splunk on All Apps and Add-ons. 08-18-2020 03:10 AM
- Got Karma for How to create matching log with CIM "proxy" data model to see information in ES?. 06-05-2020 12:49 AM
- Posted Apex Central - Log doesn't match on All Apps and Add-ons. 03-06-2020 07:04 AM
- Tagged Apex Central - Log doesn't match on All Apps and Add-ons. 03-06-2020 07:04 AM
- Posted Re: Microsoft Windows defender Data not coming on All Apps and Add-ons. 10-23-2019 07:54 AM
- Posted Re: AVAYA CALL: What format should I use for SMDR from Avaya Aura? on All Apps and Add-ons. 10-10-2019 02:32 AM
- Posted Re: Microsoft DNS Debug and monitorNoHandle on All Apps and Add-ons. 12-07-2018 02:39 AM
- Posted Re: Splunk App for Microsoft Exchange: Why is the app not working and generating trial license issues? on All Apps and Add-ons. 09-19-2018 02:19 AM
- Posted Re: Splunk Add-on for Microsoft Exchange: ERROR "Search-AdminAuditLog : Object reference not set to an instance of an object." on All Apps and Add-ons. 09-17-2018 07:32 AM
- Posted Re: Veeam Backup TA on All Apps and Add-ons. 09-14-2018 05:01 AM
- Posted Re: How to create matching log with CIM "proxy" data model to see information in ES? on Splunk Enterprise Security. 06-18-2018 10:06 AM
- Posted Re: How to create matching log with CIM "proxy" data model to see information in ES? on Splunk Enterprise Security. 06-18-2018 08:35 AM
- Posted How to create matching log with CIM "proxy" data model to see information in ES? on Splunk Enterprise Security. 06-15-2018 07:53 AM
- Tagged How to create matching log with CIM "proxy" data model to see information in ES? on Splunk Enterprise Security. 06-15-2018 07:53 AM
- Tagged How to create matching log with CIM "proxy" data model to see information in ES? on Splunk Enterprise Security. 06-15-2018 07:53 AM
- Tagged How to create matching log with CIM "proxy" data model to see information in ES? on Splunk Enterprise Security. 06-15-2018 07:53 AM
- Tagged How to create matching log with CIM "proxy" data model to see information in ES? on Splunk Enterprise Security. 06-15-2018 07:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 |
03-06-2020
07:04 AM
Can anyone help me with this?
The logs now are in Apex Central format, as TMCM now is Apex Central.
However it seems the logs changed, and the TA for Trend Micro OfficeScan doesn't work porperly.
Is there anyone who made this work?
My logs now are as follow:
Mar 6 12:01:05 Apex Central:700107 Generated="2020-03-06 11:49:05" Product_Entity/Endpoint="BRAHMS_OSCE" Endpoint="M32124" Managing_Server="BRAHMS" Product="Apex One" Target_Process="C:\Windows\System32\wbem\WmiPrvSE.exe" File_Name="\Device\Harddisk1\DR1" Device_Type="USB storage device" Permission="List device content only"
... View more
10-23-2019
07:54 AM
@thambisetty is the app supported on splunk 7.2, 7.3 or 8.0?
... View more
10-10-2019
02:32 AM
Hi Jean-Louis, do you have a way for us to use the AVAYA_Call app, with the AVAYA Aura System?
Please let me know. Thanks in advance.
Since Aura doesn't support SMDR don't know how i can solve this 😕
... View more
12-07-2018
02:39 AM
I'm having exactly the same issue.
I had before MonitorNoHandle working, with the dns log in the default path: C:\Windows\System32\dns\dns.log
However after updating the windows server (the dns server) I stopped receiving anything from this file on Splunk.
Is there any reason for this?
Anyone solved this situations?
... View more
09-19-2018
02:19 AM
I'm exactly with the same issue.
Did you managed to fix it?
... View more
09-17-2018
07:32 AM
I'm having issues with this also. But I'm running splunk service, with a domain service account.
What relevant roles we need to give to that domain account?
... View more
09-14-2018
05:01 AM
Have you updated the app? I only can see it on version 1, and was thinking to start using it to monitor my veeam.
... View more
06-18-2018
10:06 AM
Yeh, I was able to map some fields with the CIM fields, but wasn't getting/receiving any notable events or anything. Anyway, something happened that now it seems my events doesn't match to the web datamodel anymore. Trying to sort it out.
... View more
06-18-2018
08:35 AM
1 Karma
Ok, and for notable events and such, is normal that I don't see anything then. I will also then need to configure alerts by myself I suppose? I was expecting that if i map all the available fields on the barracuda proxy log, to the CIM proxy model, I would automatically get some "view info" and alerts/notable events automatically. That's the use of CIM right, to create a common model that allows for easy integration.
Thanks for the presentation also, I checked it before, but is kinda empty.
... View more
06-15-2018
07:53 AM
1 Karma
I'm receiving logs from a Barracuda Web Security Gateway into splunk.
I've created a field extraction rule inline, getting the fields to extract to match the fields of the CIM data-model for web proxy.
Some of the fields like "cached", "cookies", "bytes_in" etc, are not present on the Barracuda logs, so i was thinking i could just ignore them.
The barracuda log structure can be found here: https://campus.barracuda.com/product/websecuritygateway/doc/6160435/syslog-and-the-barracuda-web-security-gateway/
after matching the most relevant fields, I went to Enterprise Security, to see if I can have some information regarding ES.
When I go into Enterprise security and check the data model web, I get some matches:
Am I doing this the right way?
There are not many videos teaching how to use ES. This is a clean Splunk install with just the barracuda proxy logs and some event logs.
Can anyone put me on the right track? Thank you
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-27-2021
01:50 PM
|
