trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #264 from clong/fix_wef_inputs

Browse Source 
Fix WEF inputs for Splunk
This commit is contained in:
Chris Long
2019-04-28 13:14:22 -07:00
committed by GitHub
parent 12c1ca677e 3de47b621a
commit 8212f4c259
2 changed files with 31 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Vagrant/bootstrap.sh
View File

@@ -79,14 +79,15 @@ install_splunk() {
echo "Splunk is already installed" echo "Splunk is already installed"
else else
echo "Installing Splunk..." echo "Installing Splunk..."
# Get Splunk.com into the DNS cache. Sometimes resolution randomly fails during wget below # Get download.splunk.com into the DNS cache. Sometimes resolution randomly fails during wget below
dig @8.8.8.8 splunk.com dig @8.8.8.8 download.splunk.com > /dev/null
dig @8.8.8.8 splunk.com > /dev/null
mkdir splunk mkdir splunk
# Try to resolve the latest version of Splunk by parsing the HTML on the downloads page # Try to resolve the latest version of Splunk by parsing the HTML on the downloads page
echo "Attempting to autoresolve the latest version of Splunk..."
LATEST_SPLUNK=$(curl https://www.splunk.com/en_us/download/splunk-enterprise.html | grep -i deb | grep -Eo "data-link=\"................................................................................................................................" | cut -d '"' -f 2) LATEST_SPLUNK=$(curl https://www.splunk.com/en_us/download/splunk-enterprise.html | grep -i deb | grep -Eo "data-link=\"................................................................................................................................" | cut -d '"' -f 2)
# Sanity check what was returned from the auto-parse attempt # Sanity check what was returned from the auto-parse attempt
echo "Attempting to autoresolve the latest version of Splunk..."
if [[ "$(echo $LATEST_SPLUNK | grep -c "^https:")" -eq 1 ]] && [[ "$(echo $LATEST_SPLUNK | grep -c "\.deb$")" -eq 1 ]]; then if [[ "$(echo $LATEST_SPLUNK | grep -c "^https:")" -eq 1 ]] && [[ "$(echo $LATEST_SPLUNK | grep -c "\.deb$")" -eq 1 ]]; then
echo "The URL to the latest Splunk version was automatically resolved as: $LATEST_SPLUNK" echo "The URL to the latest Splunk version was automatically resolved as: $LATEST_SPLUNK"
echo "Attempting to download..." echo "Attempting to download..."

27
Vagrant/resources/splunk_forwarder/wef_inputs.conf
View File

@@ -384,6 +384,33 @@ start_from = oldest
current_only = 0 current_only = 0
checkpointInterval = 5 checkpointInterval = 5
[WinEventLog://WEC7-Active-Directory]
sourcetype = WinEventLog:Security
source = WinEventLog:Active-Directory
index=wineventlog
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
[WinEventLog://WEC7-Terminal-Services]
sourcetype = WinEventLog:Security
source = WinEventLog:Terminal-Services
index=wineventlog
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
[WinEventLog://WEC7-Privilege-Use]
sourcetype = WinEventLog:Security
source = WinEventLog:Privilege-Use
index=wineventlog
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
[monitor://c:\pslogs] [monitor://c:\pslogs]
index = powershell index = powershell
sourcetype = powershell_transcript sourcetype = powershell_transcript