I'm trying to get the Splunk Enterprise Security Malware dashboards to populate: I'm ingesting data from symantec using the Splunk_TA_symantec-ep V3.0.1 TA which is indexing my data correctly from the dump files on the symantec management server. These are being forwarded by UF to an indexer (also with the app installed) and finally to the search head (also with the app installed) In the Enterprise Security app I have checked that the data model receives data following this YT Demystifying the CIM I can run Pivot searches and confirm that the data is being correctly picked up with associated event fields as descibed in the video and evidenced by the screenshot below. I can confirm the Data Model can access the index storing the symantec data via the CIM-configuration, and I have accelerated the data model. But still no population of the dashboards. Any help would be greatly appreciated. ... View more

Hi Everyone, I've inherited a splunk platform and need assistance with syslog configuration. The current configuration is not of my design, so I would appreciate constructive critisism on how it could be improved. I'm trying to ingest events for the symantec endpoint protection app via syslog and below is a diagram of my current setup. The problem is that the dashboards & searches for the symantec app aren't picking up any data, presumably due to the various configurations of inputs.conf (1)I have the SEP sending syslog data to my Kiwi Syslog server, (2)Which in turn writes these events to a flat file located at "E:\SEP......txt" (3)For other apps, there's an inputs.conf as defined below that's monitoring for those flat files and assigning a source/sourcetype (4)Splunk is installed on the syslog server as a Heavy Forwarder that's configured to send events to the indexer. (Which also has the SEP_TA installed) Some syslog monitors were already setup using the inputs.conf of a bespoke syslog app on the heavy forwarder/kiwi server There are many monitor stanza's contained within this bespoke app all pointing to the flat files that are exported from kiwi as follows: [monitor://E:\Syslog\CiscoASA\...\*] disabled = 0 host_segment = 3 sourcetype = cisco:asa index = company_syslog [monitor://E:\Syslog\Juniper\...\*] disabled = 0 host_segment = 3 sourcetype = juniper index = company_syslog [monitor://E:\Syslog\CiscoWireless\...\*] disabled = 0 host_segment = 3 sourcetype = syslog index = company_syslog [monitor://E:\Syslog\FireEye\...\*] disabled = 0 host_segment = 3 sourcetype = syslog index = company_syslog [monitor://E:\Syslog\SEP\...\*] disabled = 0 host_segment = 3 sourcetype = symantec index = company_syslog Although I've tried adding my own stanza pointing to the path, I can ingest data however the associated SEP dashboards don't populate. I notice also that the sourcetype is exactly as I define it in inputs.conf as "symantec" however in the SEP_TA app I notice it's looking for sourcetypes that match "symantec:atp:incidents" or "symantec:atp:incidentevents" Where do I need to define the inputs that came with the SEP_TA? do I copy those over to my bespoke syslog app which has the monitor stanza's referenced above? I notice the SEP_TA app's inputs.conf has script stanzas instead of monitoring as above. Will it cause any problems to have both [monitor] & [script] stanzas in the same inputs.conf? Example: [script://$SPLUNK_HOME/etc/apps/TA-symantec_atp/bin/atp_incidents_collect.py] interval = 600 source = symantec_atp sourcetype = symantec:atp:incidents passAuth = splunk-system-user disabled = True #index = main Will there be any issue adding the entries from the SEP_TA inputs.conf to the bespoke syslog app inputs.conf to have it perform the same functions? Best Regards, Monty ... View more

From the splunk windows_TA guide "The following keys are equivalent to the fields which appear in the text of the acquired events: Category CategoryString ComputerName EventCode EventType Keywords LogName **Message** OpCode RecordNumber Sid SidType SourceName TaskCategory Type User" I'm trying to filter on the contents of the "Message" field: An operation was attempted on a privileged object. Subject: Security ID: ROOT\username Account Name: username Account Domain: DOMAINNAME Logon ID: 0x200ABCD1 Object: Object Server: Security Object Type: - Object Name: - Object Handle: 0x1234 Process Information: Process ID: 0x12A3 Process Name: **C:\Program Files\Veeam\Backup and Replication\Console\veeam.backup.shell.exe** Requested Operation: Desired Access: 1234567 Privileges: SeTakeOwnershipPrivilege I'm looking to match on the "C:\Program Files\Veeam\Backup and Replication\Console\veeam.backup.shell.exe" portion and discard the events through a blacklist stanza in the inputs.conf on the Universal Forwarder. Something like: blacklist3 = | key=regex [key=REGEXHERE?] Is this possible? and can anyone help with the regex? ... View more

I have configured the box add-on correctly, however I am receiving the following error on the web portal under "Messages" Search peer splunk-par-peer.geant.net has the following message: Received event for unconfigured/disabled/deleted index=boxdata with source="source::https://api.box.com::BoxInputEvents" host="host::splunk-fra-sh.geant.net" sourcetype="sourcetype::box:events". So far received events from 2 missing index(es). ... View more

Hi all, I've read the troubleshooting page regarding Oauth session tokens (Can't post a link due to karma) and how they refresh every 2 hours, however I'm getting the following entries every 2/3mins (Not every 2hours as the troubleshooting guide states) Found by running the following search: eventtype=box_ta_log_error docs.splunk .com/Documentation/AddOns/released/Box/Troubleshooting#OAuth_access_token_and_refresh_token_expiration_behavior As far as I can tell the add-on is configured correctly, and is receiving events, but these errors are a bit erroneous. 2019-04-16 08:11:19,609 ERROR 140034471249664 - Failed to connect url=https://api.box.com/2.0/events?stream_type=admin_logs&limit=500&stream_position=1152923059666091010&created_after=2019-04-12T08:55:20-00:00&created_before=2019-04-16T08:11:19-00:00, input_name=box_service://BoxInputEvents, endpoint=events, message={"error":"invalid_client","error_description":"The client credentials are invalid"}, status=400, code=, context_info=Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_box/bin/box_client.py", line 134, in make_request params=params) File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/client/client.py", line 317, in make_request return self._session.request(method, url, **kwargs) File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 456, in request response = self._prepare_and_send_request(method, url, **kwargs) File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 299, in _prepare_and_send_request **kwargs File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 380, in _make_request **kwargs File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 183, in _retry_request_if_necessary self._renew_session(network_response.access_token_used) File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 148, in _renew_session self._oauth.refresh(access_token_used) File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/oauth2.py", line 209, in refresh return self._refresh(access_token_to_refresh) File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/oauth2.py", line 164, in _refresh return self.send_token_request(data, access_token) File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/oauth2.py", line 289, in send_token_request raise BoxOAuthException(network_response.status_code, network_response.content, url, 'POST') BoxOAuthException: Message: {"error":"invalid_client","error_description":"The client credentials are invalid"} Status: 400 URL: https://api.box.com/oauth2/token Method: POST ... View more