Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cdupuis123
cdupuis123
Path Finder
Member since:
11-07-2011
06-05-2020
Community Statistics
| Posts | 34 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 10 |
| Member Since | 11-07-2011 |
Activity Feed
- Got Karma for Re: Why is heavy forwarder repeatedly getting "WARN TcpOutputProc - Forwarding to indexer group default-autolb-group blocked for 600 seconds.". 06-05-2020 12:47 AM
- Got Karma for Why is the Splunk Add-on for Bro IDS not automatically extracting the fields?. 06-05-2020 12:47 AM
- Got Karma for Why isn't the new Splunk Add-on for Bro IDS 3.1.4 parsing Bro fields from the files?. 06-05-2020 12:47 AM
- Got Karma for Why isn't the new Splunk Add-on for Bro IDS 3.1.4 parsing Bro fields from the files?. 06-05-2020 12:47 AM
- Got Karma for How to configure regex for transforms.conf and props.conf to send specified IIS data to nullQueue?. 06-05-2020 12:47 AM
- Got Karma for Re: How to configure regex for transforms.conf and props.conf to send specified IIS data to nullQueue?. 06-05-2020 12:47 AM
- Got Karma for Re: How to filter out multiple fields in the same transform with regex?. 06-05-2020 12:47 AM
- Got Karma for How to configure an FS-ISAC feed in Splunk App for Enterprise Security 3.3 with a Soltra Edge server?. 06-05-2020 12:47 AM
- Got Karma for How to configure an FS-ISAC feed in Splunk App for Enterprise Security 3.3 with a Soltra Edge server?. 06-05-2020 12:47 AM
- Got Karma for How to configure an FS-ISAC feed in Splunk App for Enterprise Security 3.3 with a Soltra Edge server?. 06-05-2020 12:47 AM
- Posted Re: How to configure an FS-ISAC feed in Splunk App for Enterprise Security 3.3 with a Soltra Edge server? on Splunk Enterprise Security. 11-04-2015 12:00 PM
- Posted Re: How to configure an FS-ISAC feed in Splunk App for Enterprise Security 3.3 with a Soltra Edge server? on Splunk Enterprise Security. 11-02-2015 11:40 AM
- Posted Re: How to configure an FS-ISAC feed in Splunk App for Enterprise Security 3.3 with a Soltra Edge server? on Splunk Enterprise Security. 10-29-2015 12:44 PM
- Posted How to configure an FS-ISAC feed in Splunk App for Enterprise Security 3.3 with a Soltra Edge server? on Splunk Enterprise Security. 09-29-2015 05:50 AM
- Tagged How to configure an FS-ISAC feed in Splunk App for Enterprise Security 3.3 with a Soltra Edge server? on Splunk Enterprise Security. 09-29-2015 05:50 AM
- Tagged How to configure an FS-ISAC feed in Splunk App for Enterprise Security 3.3 with a Soltra Edge server? on Splunk Enterprise Security. 09-29-2015 05:50 AM
- Tagged How to configure an FS-ISAC feed in Splunk App for Enterprise Security 3.3 with a Soltra Edge server? on Splunk Enterprise Security. 09-29-2015 05:50 AM
- Posted Why is searching with NOT or != being ignored in search results? on Splunk Search. 08-26-2015 05:30 AM
- Tagged Why is searching with NOT or != being ignored in search results? on Splunk Search. 08-26-2015 05:30 AM
- Posted Re: ES/third man user is being picked up as unknown? on All Apps and Add-ons. 08-19-2015 06:33 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 3 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
11-04-2015
12:00 PM
ok this was a complete PITA from the work GO. klaxdal thanks a ton for pointing me in the right direction it was excatly what I was looking for. I still had a couple challenges like my Edge server decided to stop working on Oct 22, then I had the challenge if fighting the 2 factor cert within Edge. I had to hard code the username an password instead of using the cred manager in Splunk? I may try to back that off tomorrow as I was giddy to actually see data in Splunk ES....
... View more
11-02-2015
11:40 AM
Getting closer! Splunk says I'm missing collection. Digging through the Soltra documentation again, case I missed something...
2015-11-02 14:36:19,798 ERROR pid=21869 tid=MainThread file=threatlist.py:download_taxii:248 | status="Exception when polling TAXII feed." Traceback (most recent call last): File "/opt/splunk/etc/apps/SA-ThreatIntelligence/bin/threatlist.py", line 231, in download_taxii for count, content_block in enumerate(handler.run(args, handler_args)): File "/opt/splunk/etc/apps/SA-ThreatIntelligence/bin/taxii_client/init.py", line 123, in run parsed_args = self.parse_args(args, handler_args) File "/opt/splunk/etc/apps/SA-ThreatIntelligence/bin/taxii_client/init_.py", line 95, in _parse_args raise TaxiiHandlerException('Invalid arguments for TAXII service (missing collection).') TaxiiHandlerException: Invalid arguments for TAXII service (missing collection).
... View more
10-29-2015
12:44 PM
NO! I have the edge server still running I've asked several folks on here, on Soltra, and even dug though the fsisac forums and asked an engineer there. I'm sure I have a config issue, but the documentation leaves me stranded. Let me know what you find as I'm to the point now of asking my pro-serve person to ask folks that he has run across!....
... View more
09-29-2015
05:50 AM
3 Karma
1st time configuring a feed in the Splunk App for Enterprise Security and I'm spinning my wheels. HELP 🙂 I have the Soltra server running and downloading the FS-ISAC feed, but how to I set it up in Splunk? By setup, I mean syntax in the Splunk URL & post arguments.
Thanks in advance!
... View more
08-26-2015
05:30 AM
Anyone else seen this before? I'm building a search, then telling Splunk to NOT or using field!=something and Splunk is straight up ignoring it and showing the field anyway I've tried using quotes, NOT versus != and explicit typing out the value instead of using a wildcard.
... View more
- Tags:
- search
08-19-2015
06:33 AM
yes, that description is from the notable event in the IR dash. The CIM tags don't have unknown.?.? Would love to make this work in my environment! Wicked cool idea.....
... View more
08-19-2015
06:07 AM
Description:
User unknown successfully authenticated to unknown from unknown via unknown, which is unusual and likely indicates a compromised account
... View more
05-29-2015
07:22 AM
Thanks woodcock, so I assume this is bad:
main sep_risk SERVERNAME -282.000000
Any ideas or threads on how to fix this? /back to splunk answers......
... View more
05-28-2015
11:58 AM
No sir, and yes there's data in the file, it's not a chatty one, but last update was at 1:31 EST today, small file though only 10kb, could that be something???
... View more
05-28-2015
07:45 AM
Beating my head off this one guys. I'm simply trying to forward several logs from my SEPM (SYmantec EndPoint Manager). All except the risk log is staying up to date. I've restarted the manager service to have it create it's local type backup of .txt files and changed my input to have it read the agt_risk.txt and it still doesn't make it. The forwarder read the file yesterday! What am I doing wrong?
Excerpt from the splunkd.log:
05-28-2015 10:31:05.516 -0400 INFO TailingProcessor - Parsing configuration stanza: monitor://D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_risk.txt.
05-28-2015 10:31:05.516 -0400 INFO TailingProcessor - Parsing configuration stanza: monitor://D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_scan.tmp.
05-28-2015 10:31:05.517 -0400 INFO TailingProcessor - Parsing configuration stanza: monitor://D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_security.tmp.
05-28-2015 10:31:05.517 -0400 INFO TailingProcessor - Parsing configuration stanza: monitor://D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_system.tmp.
05-28-2015 10:31:05.517 -0400 INFO TailingProcessor - Parsing configuration stanza: monitor://D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_traffic.tmp.
05-28-2015 10:31:05.518 -0400 INFO TailingProcessor - Adding watch on path: D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_behavior.tmp.
05-28-2015 10:31:05.518 -0400 INFO TailingProcessor - Adding watch on path: D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_proactive.tmp.
05-28-2015 10:31:05.518 -0400 INFO TailingProcessor - Adding watch on path: D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_risk.txt.
My inputs.conf
[monitor://D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_behavior.tmp]
disabled = false
crcSalt = <SOURCE>
sourcetype = sep_behavior
[monitor://D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_risk.txt]
disabled = false
crcSalt = <SOURCE>
sourcetype = sep_risk
[monitor://D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_scan.tmp]
disabled = false
crcSalt = <SOURCE>
sourcetype = sep_scan
[monitor://D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_security.tmp]
disabled = false
crcSalt = <SOURCE>
sourcetype = sep_security
[monitor://D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_system.tmp]
disabled = false
crcSalt = <SOURCE>
sourcetype = sep_system
[monitor://D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_traffic.tmp]
disabled = false
crcSalt = <SOURCE>
sourcetype = sep_traffic
[monitor://D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump\agt_proactive.tmp]
disabled = false
crcSalt = <SOURCE>
sourcetype = sep_proactive
Yes I know I'm trying to read the agt_risk.txt and the rest of the inputs are .tmp files. This is me trouble-shooting.
I'm stumped. The version of the forwarder I'm running is: 6.2.2
The size of the file I'm struggling with is: 97kb
... View more
04-08-2015
11:20 AM
side question arthurbreuer
My bro sensors name the the log files conn.log, weird.log, http.log etc etc. I'm trying to use the new Splunk_TA_bro but in the props.conf on my indexer it seems to hate the fact that my bro log aren't named bro.whateverfile.log what are folks doing to work around this? I've set the source to [source::...*.log] then in the enrich bro logs area I've set the regex to this:
[(?::){0}.log]
[(?::){0}bro_*] original
then in my transforms I set the [BroAutoType] to:
REGEX = ([a-zA-Z]+).log
REGEX = (?:[a-zA-Z0-9]+.)?([a-zA-Z0-9]+).log original
I stood up a test bro sensor today to see if I could change the way bro writes it's logs but it didn't jump out at me.....
Thanks in advance
... View more
04-07-2015
03:09 AM
Yes thanks rsennett, I'm only running the TA on a heavy forwarder & Indexer, in trouble-shooting I also removed the heavy as a possible issue, still the TA isn't extracting the fields....
stillstymied
Thanks
... View more
04-04-2015
03:51 AM
2 Karma
Any thoughts on why the new Splunk Add-on for Bro IDS isn't formatting the BRO fields in the files? Do I need to manually re-create them? None of these fields are coming in:
ts
uid
id.orig_h id.orig_p id.resp_h
id.resp_p
proto
service
duration orig_bytes
resp_bytes
conn_state
local_orig
missed_bytes
history
orig_pkts
orig_ip_bytesresp_pkts
resp_ip_bytes
tunnel_parents
What am I doing wrong!!!! Thanks in advance!
... View more
04-03-2015
11:49 AM
1 Karma
example bro_notice fields go ts (tab) uid (tab) id.orig_h (tab) etc etc splunk is like ignoring these????? Do I need to manually recreate all the fields????
... View more
03-15-2015
11:21 AM
1 Karma
Thanks for the help eddit0r worked mint after I figured out that the space between:
TRANSFORMS-setnullqueue = setnull1, setnull2
should not be there. Found another thread titled "Filtering Windows event logs" then changed my props and volia! v8 moment...
Working now!
... View more
03-15-2015
02:36 AM
Well thanks for the suggestion, but neither are working. It seems that it only process's one transform. My last attempt my props was this:
[WinEventLog:Security]
TRANSFORMS-set = setnull1
TRANSFORMS-set = setnull5
[WinEventLog:security]
TRANSFORMS-set = setnull1
TRANSFORMS-set = setnull5
And my transforms is this:
bit bucket for windows security events
[setnull1]
REGEX=(?m)EventCode=(515|517|537|538|540|551|552|560|565|566|576|577|578|592|593|600|601|626|627|628|629|633|641|642|645|646$
DEST_KEY = queue
FORMAT = nullQueue
[setnull5]
REGEX=user=someusername
DEST_KEY = queue
FORMAT = nullQueue
I attempted to add "user=" on the end of the close "paran )" but Splunk just ignored it.
I'm stymied
... View more
03-06-2015
02:46 AM
I’m in a pickle (splunk license) again this morning and I’m trying to address it via a transform.
bit bucket for windows security events
[setnull1]
REGEX=(?m)EventCode=(515|517|537|538|540|551|552|560|565|566|576|577|578|592|593|600|601|626|627|628|629|633|641|642|645|646|647|659|660|661|664|665|666|671|672|673|674|675|680|682|683|684|832|833|835|836|837|861|4688|4902|4674|4675|4663$
REGEX=(user= someuserid|anotheruserid|anotheruserid)
DEST_KEY = queue
FORMAT = nullQueue
The stuff I've commented out below doesn’t work:
REGEX=(user=someuserid|anotheruserid|anotheruserid)
DEST_KEY = queue
FORMAT = nullQueue
How can I accomplish this? Basically my issue is I have a working transform for:
[WinEventLog:Security]
TRANSFORMS-set = setnull1
[WinEventLog:security]
TRANSFORMS-set = setnull1
I need to regex out another field in the same transform. Is this possible?
... View more
03-05-2015
02:36 AM
1 Karma
Hi inters
Yes I've spent time on the answers site with similar results, but after using/running Splunk now for 3 years I've found that if I can't get the answer from Splunk answers I've either used the wrong search term, or most times I find something close and am able to backwards/sideways engineer it until it fixes my issue. Oh course if all else fails call my SE or Support. Good luck with your POC
... View more
01-12-2015
09:34 AM
I don't have the answer, but I've got the same issue!!!! Anyone????
... View more
09-29-2014
11:50 AM
1 Karma
Update apparently in Splunk v6 we can now transform IIS, & csv logs on the Universal Forwarder! News to me. Next hurtle (for me) was getting it to work on the UF, as it would work fine in the etc\system\local (not possible I think from a deployment server) but wouldn't work in the app directory. My SE pointed out the fact that I needed to basically declare in the app metadata directory add to the default.meta:
[props]
export = system
[transforms]
export = system
I've learned something new, and hope others figured this out faster than I!!!! Regardless it's documented now.
Thanks Jeff
... View more
09-22-2014
01:00 PM
rtafoya you ever figure this out? I'm have the same type issue trying to nullQueue some load balancer noise out of the indexer. thanks!
... View more
09-17-2014
04:05 PM
ya I figured that out martin, thanks regex is still stumping me....
... View more
09-17-2014
03:43 PM
Maybe that's my issue, I'm pumping these IIS logs into an iis index, when I search index=iis the sourcetype of iis comes back, but when I search sourcetype=iis I get nothing?????
... View more
09-17-2014
01:17 PM
1 Karma
Trying to dump off what seems like a simple thing to do from raw iis logs.
just want to not allow this to index: cs_uri_stem = /CLBOnline/AppOnline
my props.conf is
[iis]
TRANSFORMS-set = setnull1
my transforms.conf is
bit bucket for IIS
[setnull1]
REGEX=\/CLBOnline\/AppOnline
DEST_KEY = queue
FORMAT = nullQueue
I'm running Splunk 6.1
... View more
06-02-2014
01:01 PM
I now have a deployment server and want to get a handful of Linux forwarders talking to it. On Windows it's pretty straight forward with the MSI install switches, but how do I change the linux install?
... View more
- Tags:
- forwarders
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
