I don't think cylance supports HEC as an output at this time. There's an existing enhancement request if you login to cylance's support portal. Upvote it and maybe that will help get some traction from their development team. ... View more

I have an identical one running in a python script that returns around 26k values, however the exact same query in the app only returns around 14k values. I also enabled debug logging & don't see any errors. My query is as follows: SELECT IPAddress AS ip, SubnetId, DhcpClientName as dns, ToLower(MAC) AS mac FROM IPAM.IPNode WHERE mac IS NOT NULL Python code: qr = swis.query("SELECT IPAddress AS ip, SubnetId, DhcpClientName as dns, ToLower(MAC) AS mac FROM IPAM.IPNode WHERE mac IS NOT NULL") Any advice on next steps to troubleshoot would be appreciated. ... View more

Seeing the same issue here but with 6.6.3. I'm in AWS with my instance, no errors within _internal I can find. I'm going to check VPC flow logs and see if it's making the connection at all. ... View more

Hi aaraneta - we use suricata and have done the following: install the TA: https://splunkbase.splunk.com/app/2760/ Configure suricata.yaml to log eve.json: https://redmine.openinfosecfoundation.org/projects/suricata/wiki/EveJSONFormat Configure a UF on the sensor to read the eve.json file: inputs.conf: index = suricata sourcetype = suricata disabled = false The app is CIM compatible so it should show up in your datamodels. If not, you might need to restrict the DM constraints to the index or sourcetypes you're using. ... View more

Hi guarisma - you can see what's CIM compatible by looking at the tags.conf and probably eventtypes.conf files in the TA - usually eventtypes have been tagged with CIM-compatible tags as a sort-of best practice. If something has a tag that matches a CIM tag then that's where you're going to see it map into the CIM. At first glance, I don't see any tags in the TA, so I don't believe any work has been done to that TA. ... View more

I haven't used this but it does appear to have the CIM mappings you'll need: https://splunkbase.splunk.com/app/3208/ ... View more

Not sure when it was introduced, but you can now overwrite with a lookup: http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Lookup ... View more

Not sure when it was introduced, but you can now overwrite fields: http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Lookup ... View more

I cleared out all of the lookup tables - they're all kvstore inputs in the collections.conf file inside /opt/splunk/etc/apps/DA-ESS-ThreatIntelligence/default | inputlookup ip_intel | head 10 | outputlookup ip_intel | inputlookup certificate_intel | head 1 | outputlookup certificate_intel | inputlookup file_intel | head 1 | outputlookup file_intel | inputlookup process_intel | head 1 | outputlookup process_intel There's probably a cleaner way to do this, but that's how I'm trying to get rid of them. ... View more

Quantcast might be useful as a replacement if Alexa does wind up retiring it: https://ak.quantcast.com/quantcast-top-sites.zip ... View more

If you can get ahold of the MIB you might be able to create a lookup table and match up those values with the text of the MIB. Something like this: OID,name 1.3.6.1.4.1.1046.11.1.1.1.1.1, Version 1.3.6.1.4.1.1046.11.1.1.1.1.2, Box 1.3.6.1.4.1.1046.11.1.1.1.1.3, Port Although looking at the data is splunk extracting each OID as a separate field? ... View more

A very interesting problem. I have a similar need and haven't decided on a solution. Just thinking a bit about it leads me to maybe try something like this: SH1 - build the lookup (this is the "master" lookup) Index the lookup into a 'transportation' index (mine is called test): | inputlookup test | collect index=test SH2 - populate the lookup: index=test | outputlookup test Anyway, I'll poke around a bit with this and repost if I come up with my own solution. ... View more

Well the format isn't really configurable, we're just adding some more 'metadata' to the policy name. Since Brian Torres-Gil below works for Palo Alto (and wrote this app), he might be able to ask that they log tags or some other field we could parse on ingest.. Either way - whatever works! ... View more

Hi arunkuriakose - I'd recommend you use chrome and start the 'developer tools' to see if there are any errors. Incident review is most likely some javascript and perhaps your browser is blocking the code for some reason. You might also try clearing everything in your browser and trying a different browser to see if the same thing applies to different situations - I've seen weirdness before with chrome and safari exhibiting different behavior. Also try incognito mode and see if that does something different. ... View more

You should verify you have 'change authentication' as part of the admin role. That's my guess on that one. As far as the role mapping - have you modified OKTA to send the role of Splunk Admins over? ... View more

I created a how-to answer and added it to this question. Let me know if it works for you. ... View more

OK, I just had to add a new search head and here are my steps: Enable SSL on your splunk server Ensure you have a FQDN for your server Ensure you know your splunk server's hostname (in my case I used the EC2 hostname) Ensure you have a OKTA / AD group to map Splunk roles to OKTA SETUP: Login to OKTA and choose to create a new app (don't search for the splunk app - it won't work) Choose "create a new app" and SAML 2.0 Give it a name and click next In your new app use the following fields: Sign-On URL should be in this format: https://ec2-xx-xx-xx-xx.us-west-2.compute.amazonaws.com:8443/saml/acs (note the /saml/acs in the URL) Audience URI should be the server hostname Default RelayState should be / Name ID format: Unspecified Application username: Okta username Group statements should be role : Starts with Save the application Assign the application to users - I use the same group as the role I've mapped Download the metadata SPLUNK SETUP: Go into SAML configuration and upload the metadata file. Click apply (this might be unnecessary.. not really sure) Check Sign AuthnRequest Click SAVE Click New Group Map the role to the AD / OKTA Group name If you run into issues, you can always get back in using /en-US/account/login?loginType=splunk for local credentials ... View more

To that point, if you're going to use splunk cloud, you may want to continue down the path of infrastructure / configuration minimization. Read: a Heavy Forwarder is more infrastructure & configuration to maintain. You may need to consider them in the future, but I'd start off with just the UF for now. ... View more

Was this ever fixed? I'm seeing the same behavior in UF 6.3.3 ... View more

I'm not entirely sure what you're trying to do here, but we have done the following: use db connect and run sql query to dump out hashes of files detected by symantec (sql database) db connect populates an index=detected_hashes created CIM-compatible fields mapping the database fields to the inventory datamodel (inventory datamodel has constraint=detected_hashes) inventory datamodel can be queried to return information in the detected_hashes index all DM commands (like acceleration) work fine. ... View more

We had to do one more thing to map the roles from OKTA. Under the Group Attribute Statements, we added role, name format: unspecified, filter: starts with (name of our AD group to pass) ... View more

We're struggling with this as well since the splunk documentation isn't complete for the OKTA IdP. I have a support case open, but here's what I've been able to do w/o support so far: First, I believe the sso url should be /saml/acs Under group attribute statements on OKTA, put http://schemas.microsoft.com/ws/2008/06/identity/claims/role and then your group filter. We named them all with role-splunk* in them and verified using SAML tracer that they're coming over. Now I see this: No valid splunk role found in the local mapping or assertion. I verified the rolemap_saml configuration in authentication.conf. ... View more