cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
siuolkl
Explorer
Member since: ‎03-15-2022
‎04-07-2024
Community Statistics
Posts 7
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎03-15-2022
View All

Guidance Needed on Sysmon Configuration for inputs...

by in Installation
‎04-07-2024 03:19 AM
‎04-07-2024 03:19 AM
hi experts seek assistance with configuring Sysmon for inputs.conf on a Splunk Universal Forwarder. Configuration based on the Splunk Technology Add-on (TA) for Sysmon. [WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = false renderXml = 1 source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational index = sysmon is this the correct config ? ... View more
Labels

How go integrate nifi to splunk httpinvokve proces...

by in Security
‎10-31-2022 07:00 PM
‎10-31-2022 07:00 PM
hi experts by any chance if anyone has intergrate nifi to splunk via using httpinvoke processor. for this testing im generating self sign cert using openssl to test https from splunk where do i generate my self sign certs , CA should i follow this link ? https://docs.splunk.com/Documentation/Splunk/9.0.1/Security/Howtoself-signcertificates appreciate any help or resource which i can reference ... View more
Labels

How to deploy Splunk HF to two indexers?

by in Deployment Architecture
‎10-18-2022 01:54 AM
‎10-18-2022 01:54 AM
hi experts trying to deploy a HF and forward logs to 2 different indexers. clone data i have 2 UFs feeding windows and syslog logs respectively to a HF. This is my HF output conf, i think there some thing wrong here as i can only see logs at my indexer1 [tcpout] defaultGroup=windows,syslog [tcpout:windows,syslog] server=indexer1 ip:9997 [tcpout:windows,syslog] server=indexer2 ip:9997 appreciate any help.     ... View more
Labels

When Installing Splunk Add-on for McAfee Web Gatew...

by in Installation
‎06-24-2022 08:54 PM
‎06-24-2022 08:54 PM
Hi Experts, Trying to install the Add-on for McAfee Web Gateway via the GUI method. Keep getting this error from the page below. by any chance, if anyone knows how to solve it, is there something needed to be tweaked for this to work. There was an error processing the upload.Invalid app contents: archive contains more than one immediate subdirectory: and Splunk_TA_mcafee-wg Appreciate any help. https://splunkbase.splunk.com/app/3009/   ... View more
Labels

Re: microsoft defender add on using certificates

by in Deployment Architecture
‎03-15-2022 06:40 PM
‎03-15-2022 06:40 PM
@VatsalJagani  hello thank you for the reply. the add on is working fine but I am posting this question as my environment requires the use of certificates. I am not sure if splunk support this method.   Also from Microsoft documentation. the option to use cert is more secure compared to client secrets for app registration from azure. https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app    ... View more

Can microsoft defender add on use certificates?

by in Deployment Architecture
‎03-15-2022 05:49 AM
‎03-15-2022 05:49 AM
Hi Experts, would like to check if anyone tried using certificates for the Microsoft defender add-on. how / where do I generate the certificates to upload to azure app registration. currently from splunkbase im using this add on.  https://splunkbase.splunk.com/app/4959/#/details  would like to check if there is any supported version by splunk ?     ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎04-07-2024 06:39 AM