Is it still the case that the inputs & props included in the "Splunk TA for Suricata" are not CIM-compliant? https://splunkbase.splunk.com/app/2760/#/details If not CIM compliant, has anyone indexed these events in an ES CIM-compliant format without reinventing the wheel?   Thanks in advance! ... View more

Thanks for the input! I've tried catting my intermediate/root PEM to cacert.pem & restarted Splunk on my Windows HF and the log is: 2020-03-03 14:19:50,694 INFO pid=1140 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2020-03-03 14:20:06,312 INFO pid=1140 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2020-03-03 14:20:16,960 INFO pid=1140 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2020-03-03 14:20:27,624 INFO pid=1140 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2020-03-03 14:20:36,272 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | Log Level is set to :DEBUG 2020-03-03 14:20:36,273 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | Checkpoint key:UAB_obj_checkpoint 2020-03-03 14:20:36,273 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | Login URL:https://login.microsoftonline.com 2020-03-03 14:20:36,273 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | Endpoint : https://wdatp-alertexporter-us.securitycenter.windows.com/api/alerts 2020-03-03 14:20:36,273 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | Tenant ID:d8999fe4-76af-40b3-b435-1d8977abc08c 2020-03-03 14:20:36,273 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | Resource:https://graph.windows.net 2020-03-03 14:20:36,273 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | Client ID:463e0c66-ee95-4031-b430-00ee5a6575b2 2020-03-03 14:20:36,273 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | Start Date Input:None 2020-03-03 14:20:36,273 INFO pid=1140 tid=MainThread file=splunk_rest_client.py:_request_handler:100 | Use HTTP connection pooling 2020-03-03 14:20:36,273 DEBUG pid=1140 tid=MainThread file=binding.py:get:664 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA_windows-defender/storage/collections/config/TA_windows_defender_checkpointer (body: {}) 2020-03-03 14:20:36,275 INFO pid=1140 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 2020-03-03 14:20:36,279 DEBUG pid=1140 tid=MainThread file=connectionpool.py:_make_request:387 | "GET /servicesNS/nobody/TA_windows-defender/storage/collections/config/TA_windows_defender_checkpointer HTTP/1.1" 200 5497 2020-03-03 14:20:36,280 DEBUG pid=1140 tid=MainThread file=binding.py:new_f:71 | Operation took 0:00:00.006000 2020-03-03 14:20:36,280 DEBUG pid=1140 tid=MainThread file=binding.py:get:664 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA_windows-defender/storage/collections/config/ (body: {'count': -1, 'search': 'TA_windows_defender_checkpointer', 'offset': 0}) 2020-03-03 14:20:36,283 DEBUG pid=1140 tid=MainThread file=connectionpool.py:_make_request:387 | "GET /servicesNS/nobody/TA_windows-defender/storage/collections/config/?count=-1&search=TA_windows_defender_checkpointer&offset=0 HTTP/1.1" 200 4685 2020-03-03 14:20:36,283 DEBUG pid=1140 tid=MainThread file=binding.py:new_f:71 | Operation took 0:00:00.003000 2020-03-03 14:20:36,288 DEBUG pid=1140 tid=MainThread file=binding.py:get:664 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA_windows-defender/storage/collections/data/TA_windows_defender_checkpointer/UAB_obj_checkpoint (body: {}) 2020-03-03 14:20:36,312 DEBUG pid=1140 tid=MainThread file=connectionpool.py:_make_request:387 | "GET /servicesNS/nobody/TA_windows-defender/storage/collections/data/TA_windows_defender_checkpointer/UAB_obj_checkpoint HTTP/1.1" 404 140 2020-03-03 14:20:36,313 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | Max date before getting message: 2020-02-25 14:20:36.314000 2020-03-03 14:20:36,313 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | UTC Time Now:2020-03-03 20:20:36.314000 2020-03-03 14:20:36,315 DEBUG pid=1140 tid=MainThread file=binding.py:get:664 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA_windows-defender/storage/collections/data/TA_windows_defender_checkpointer/accesstoken (body: {}) 2020-03-03 14:20:36,316 DEBUG pid=1140 tid=MainThread file=connectionpool.py:_make_request:387 | "GET /servicesNS/nobody/TA_windows-defender/storage/collections/data/TA_windows_defender_checkpointer/accesstoken HTTP/1.1" 404 140 2020-03-03 14:20:36,318 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | get access token called 2020-03-03 14:20:36,318 INFO pid=1140 tid=MainThread file=setup_util.py:log_info:114 | Proxy is not enabled! 2020-03-03 14:20:36,318 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | Proxies set is : {} 2020-03-03 14:20:36,318 DEBUG pid=1140 tid=MainThread file=base_modinput.py:log_debug:286 | Global SSL Verify settings is: True 2020-03-03 14:20:36,342 DEBUG pid=1140 tid=MainThread file=connectionpool.py:_new_conn:809 | Starting new HTTPS connection (1): login.microsoftonline.com 2020-03-03 14:20:36,671 DEBUG pid=1140 tid=MainThread file=connectionpool.py:_make_request:400 | https://login.microsoftonline.com:443 "POST /d8999fe4-76af-40b3-b435-1d8977abc08c/oauth2/token HTTP/1.1" 401 471 2020-03-03 14:20:36,676 ERROR pid=1140 tid=MainThread file=base_modinput.py:log_error:307 | 'access_token' 2020-03-03 14:20:36,677 ERROR pid=1140 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events. Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\TA_windows-defender\bin\ta_windows_defender\modinput_wrapper\base_modinput.py", line 127, in stream_events self.collect_events(ew) File "C:\Program Files\Splunk\etc\apps\TA_windows-defender\bin\windows_defender_atp_alerts.py", line 88, in collect_events input_module.collect_events(self, ew) File "C:\Program Files\Splunk\etc\apps\TA_windows-defender\bin\input_module_windows_defender_atp_alerts.py", line 151, in collect_events "Authorization": 'Bearer ' + access_token, TypeError: cannot concatenate 'str' and 'NoneType' objects Pretty frustrating. FYI had a Splunk PS guy onsite for a couple weeks and he was clueless. ... View more

Why do you think this is the answer? I could not get it to work with the same API connection used for the Windows Defender ATP Modular Inputs TA, which works on my dev instance. The guidance directly from Microsoft is to use the Windows Defender ATP Modular Inputs TA, step 1 below: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configure-splunk ... View more

I'm having the exact same error. However, it works on my all-in-one Splunk instance but not when moved over to my HF. ... View more

I'm able to connect successfully (http 200) to https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace via Postman and also via browser with the add-on account and view data, however in splunkd.log you can observe the error: HTTP Request error: 401 Client Error: Unauthorized for url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2019-08-16T13:55:29.003668Z'%20and%20EndDate%20eq%20datetime'2019-08-16T14:55:29.003668Z' Any ideas? We're stumped with no support options. ... View more

Has anyone made any progress with this Add-on? It would be much preferable to the PS conflagration we have in place. I'm getting the 401 error in the splunkd.log as well but the user is able to access the URL and view data. ... View more

My fields are still not being extracted! I replaced the original text with the Answers text: [cyberark_epv_cef_cyberark_pta_cef_extract_field_0] REGEX = CEF:\s?(\d+)|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|((?:\||[^|]))|[^\s|]+=.* FORMAT = cef_cefVersion::$1 cef_vendor::$2 cef_product::$3 cef_version::$4 cef_signature::$5 cef_name::$6 cef_severity::$7 in: /opt/splunk/etc/apps/Splunk_TA_cyberark/default/transforms.conf Is there something I'm missing here? any help is greatly appreciated. ... View more

limits.conf doesn't exist in local. maxKBps = 0 is in limits.conf in default. 4 Indexers 1,322 KB/s Total Indexing Rate - 331 KB/s Average Indexing Rate - 264 KB/s ... View more

limits.conf doesn't exist in local. maxKBps = 0 is in limits.conf in default. 4 Indexers 1,322 KB/s Total Indexing Rate - 331KB/s Average Indexing Rate - 264 KB/s ... View more

Where would you recommend excluding this traffic? At the dashboard level or the data model level? I believe it should be a constraint in the data model, but it doesn't seem to work as expected. If at the dashboard level, where should NOT cidrmatch("192.168.0.0/16",src) go? | tstats summariesonly values(Authentication.app) as app, latest(Authentication.user_bunit) as user_bunit from datamodel=Authentication.Authentication where * by Authentication.user,Authentication.src _time span=1s | drop_dm_object_name("Authentication") | eventstats dc(src) as src_count by user | search src_count>1 | sort 0 + _time | get_asset(src) | iplocation src | eval session_city=if(isnull(src_city), City, src_city) | eval session_country=if(isnull(src_country), Country, src_country) | eval session_lat=if(isnull(src_lat), lat, src_lat) | eval session_lon=if(isnull(src_long), lon, src_long) | where isnotnull(session_lat) and isnotnull(session_lon) | streamstats current=t window=2 earliest(session_lat) as prev_lat, earliest(session_lon) as prev_lon, earliest(_time) as prev_time, earliest(src) as prev_src, earliest(session_city) as prev_city, earliest(session_country) as prev_country, earliest(app) as prev_app, latest(user_bunit) as user_bunit by user | where (src!=prev_src) | globedistance(session_lat,session_lon,prev_lat,prev_lon,"m") | eval time_diff=if((_time-prev_time)==0, 1, _time - prev_time) | eval speed = round(distance*3600/time_diff,2) | where speed>500 | uitime(prev_time) | table user, user_bunit, src, _time, session_city, session_country, app, prev_src, prev_time, prev_city, prev_country, prev_app, distance, speed If at the data model level, where should NOT (action=success user=$ src=192.168..*) go? My Authentication data model looks like: Successful Authentication Successful_Authentication CONSTRAINTS ( cim_Authentication_indexes ) tag=authentication NOT (action=success user=$) *Inherited action="success" Constraint Any guidance is appreciated, support hasn't been any help. ... View more

I'm assuming the best course of action here is to work with our AD admins to map those usernames to a more usable format & those IPs to a NATted address within the saved dashboard searches? ... View more