Lenggenhager IT Credentials Hunting App

The Credential Hunter app scans raw data in existing Splunk indexes to identify credentials that were indexed by accident, including cleartext passwords, API keys, tokens, and private keys. It employs a two-stage detection approach that combines term-index prefiltering in Splunk with regex verification in Python to minimize performance impact while maintaining accuracy. The app supports both full historical scans and continuous monitoring modes, with a configurable pattern catalog that allows administrators to enable or disable specific credential types based on their environment. Findings are stored in KV store collections and presented through dedicated dashboards for investigation, false positive management, and pattern tuning. The scanner operates as a scripted input that runs continuously but performs actual scans at administrator-defined intervals of 30 or 60 minutes. Configuration is managed through a Control room dashboard where scan intervals, event slack hours for late-arriving data, and retention policies can be adjusted without editing configuration files.