icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Cancel Visit New Splunkbase Visit
My Account
Login Signup
Support & Services
Search Splunk Documentation Splunk Answers Education & Training User Groups Splunk App Developers Support Portal Contact Us
My Account
Login Signup
Support & Services
Search Splunk Documentation Splunk Answers Education & Training User Groups Splunk App Developers Support Portal Contact Us
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Apache 2.0

Splunk Websites Terms and Conditions of Use

Thank You

Downloading SecKit Common Assets Add-on for Splunk Enterprise Security
SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_308rbaf6f27.tgz) e05aad6ceaec58f53f6efcaec467a88a807d0a32de90dd2d4be119587299eecc SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_260e1aacac.tgz) be25be4f284797fc0f8846340558ad315b0c552437920183ae4395e4662cd992 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_241rfb822c3.tgz) 9173351db41598a440c0886e12e553058d1b52b4525a95c5bf986d12f890f13c SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_240re856239.tgz) 2832e481813e95162dde57c9c8f35e4f1b912c12b72d51e744dfb6dc1bb61aef SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_228.tgz) c004e63330025ee214af96a595489af88025e83a3dfb8047f617a59bc50d3286 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_226.tgz) 83b372fb3599fd8bdbc5ee88bf7cc878607009d88df531f04475bdcefb860350 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_224.tgz) d3f2330f4bb388f59227a29db11e82695fc6cb0b3453d06b0f289d1139af76f1 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_223.tgz) 616af3a4b1188bcba8e3529c448c24baa5c10bf47feb085ec30768e082fa9a03 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_222.tgz) 3fb7c1ccbee3bb4133ae6c003a26e8130f4d06ec1717b84dc270462876727518 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_221.tgz) 47a73db4311d75e98a99cbb4c112b7f13a4f80a5f584b91cb1a8711c1e78c67f SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_210.tgz) eb9d915f59ac6bf48c5672967b91ed83a042d1b9a834ac07d4f758ec9a7fb950 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_208.tgz) 8b63bdc98e9fe0079ad9f7d99ef808c4d01bf5437d50fd067c4fd46ed809ee5c SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_206.tgz) c28ef63d00137b1748aa812d6cca592e5a4640ad86910c28deb46e1ad399086e SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_203.tgz) 7977f69781599b320e30873e35f455f439a84c0dc14e1e74d18fe972c169b00d SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_124.tgz) c7aa2fe43b09fa9432395360bd1201a7522fbaa4fd083cec21728348e39a3027 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_123.tgz) db1f2aa76c6baa05233ee309c764f6be5e7222241e75f0663a5ec873057b3637 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_122.tgz) 11d9e5f67b9c3f3f55a3ce0f06c9c8166bdf2ca53d9788e8eb19cd829fec16c3 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_111.tgz) 93190d3ed9d098f2f0035c82d8c72ea67b44826f3029e5c4cdf1e46d09110de4 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_110.tgz) e44697c8ddd86129d37da653ac73c00004d65e021c0fb9e6454db43e0dbb92b9 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_100.tgz) 7f00fa723a4bc1175cbab4a4f68fbe8a7649558e950efe8e32e9781812294454
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate
splunk

SecKit Common Assets Add-on for Splunk Enterprise Security

Splunk Cloud
Splunk Labs
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
This purpose of this Splunk Add-on is to provide foundational tools and routines for the population of assets and identities in the Enterprise Security and PCI applications for Splunk. Using this add-on develop a solid base declaration of assets with prioritization and categorization for your network.


Version 3.x is appropriate for new implementations
Version 2.x is should be updated to the latest terminal version or upgraded to 3.x

Security Kit

Identity Management Common Components

SecKit_SA_idm_common

Introduction

This purpose of this Splunk add on is to provide foundational tools and routines for the population of assets and identities in the Enterprise Security and PCI applications for Splunk.

Docs

Read The Docs
Repository

Release Notes

Version 3.0.8Rbaf6f27
Oct. 25, 2018
  • Major release please read the doc https://seckit.readthedocs.io/projects/seckit-sa-idm-common
  • Publishing Docs on Read the Docs
  • Use of collections where possible to improve performance in SHC
  • Use of first time run searches to ensure a smooth experience in Splunk Cloud
  • Improved default scheduled search configuration
  • Improved out of box experience "zero config" getting started
  • Leveraging Splunk Enterprise Security content management for all enrichment lookups.
Version 2.6.0e1aacac
Aug. 19, 2018

-Minor updates to doc, description and naming for SplunkWorks approval process
-Add copyright to files as headers
Version 2.4.1Rfb822c3
April 18, 2018

App cert fixe
Version 2.4.0Re856239
April 17, 2018

Minor updates including code clean up and additional app certification and cloud issue resolutions
Version 2.2.8
Oct. 11, 2017

Fixed is_expected output condition to use proper syntax and resolve case issue
Version 2.2.6
July 22, 2017

Moved the release server to bintray easier to release early builds now
Fixed up some small annoyances check out commits here
https://bitbucket.org/SPLServices/seckit_sa_idm_common/commits/all
Version 2.2.4
May 11, 2017

Certification Fixes
Version 2.2.3
May 10, 2017

Bug Fixes
Version 2.2.2
Feb. 1, 2017

Fixed a ugly bug causing assets to not output
Version 2.2.1
Nov. 2, 2016

-Prevent \n from remaining in the category field
-cleanup errant | from identity fields
Version 2.1.0
Oct. 3, 2016

-Add Support for ES 4.2/4.5 multi value IP and MAC in assets
Version 2.0.8
Sept. 19, 2016

Metadata file was omited fro the latest build
Version 2.0.6
Sept. 12, 2016

Fixed missing default lookups due to changes in packaging process
Fixed missing static icons
Fixed allowing bare IP and /32 CIDRs in common output
Fixed long values missing from output of CIDR Assets
Version 2.0.3
Aug. 7, 2016

-Major release possible breaking changes verify all outputs
-Minimize duplicate/conflicting true/false values
-Support pci_domain based on static host file
-Support pci_domain based on cidr match
-Dedup and filter categories at generation time (dups will occur at search time)
-Better is_expected tracker
Version 1.2.4
March 28, 2016

Fix duplicate categories on network assets
Version 1.2.3
March 11, 2016

-Fixed issue in stream dhcp search causing unchecked lookup growth
Version 1.2.2
March 10, 2016

-Fix version string
- new saved search seckit_idm_common_stream_dhcpnetworks to automatically identify and categorize dhcp managed networks based on Splunk App for stream data.
Version 1.1.1
Feb. 21, 2016

TKO Release
-Automatic set for is_expected using meta data
Version 1.1.0
Feb. 13, 2016
  • Going forward we will use categories in two formats:
  • Label - traditional word or multi word strings with underscore _ separators example retired
  • Sub Category "field:value" example net_type:internal
  • New macros
  • seckit_idm_common_get_asset_geo get geo fields by ip
  • seckit_idm_common_get_asset_net_category get network categories by ip.
  • seckit_idm_common_get_asset_net_id_category generate a net_id: category by for defined networks
  • seckit_idm_common_external_geocode defaults to NOOP for later use with max mind database
  • seckit_idm_common_build_net_assets enhancements
  • Apply net_type:internal or net_type:external based on match to RFC subnets
  • Sort the output file to ensure the most specific match is found first
Version 1.0.0
Feb. 11, 2016
4,319
Downloads
Share Subscribe LOGIN TO DOWNLOAD
Version
Built by
Splunk Works
Contributors
Ryan Faircloth
Support
Not Supported
Questions on Splunk Answers Flag as inappropriate
Compatibility
This version of the app (2.4.0Re856239) is not available for Splunk Cloud. However, version 3.0.8Rbaf6f27 of this app is available for Splunk Cloud.
This version of the app (2.2.8) is not available for Splunk Cloud. However, version 3.0.8Rbaf6f27 of this app is available for Splunk Cloud.
This version of the app (2.2.3) is not available for Splunk Cloud. However, version 3.0.8Rbaf6f27 of this app is available for Splunk Cloud.
This version of the app (2.2.2) is not available for Splunk Cloud. However, version 3.0.8Rbaf6f27 of this app is available for Splunk Cloud.
This version of the app (2.1.0) is not available for Splunk Cloud. However, version 3.0.8Rbaf6f27 of this app is available for Splunk Cloud.
This version of the app (2.0.6) is not available for Splunk Cloud. However, version 3.0.8Rbaf6f27 of this app is available for Splunk Cloud.
This version of the app (2.0.3) is not available for Splunk Cloud. However, version 3.0.8Rbaf6f27 of this app is available for Splunk Cloud.
This version of the app (1.2.3) is not available for Splunk Cloud. However, version 3.0.8Rbaf6f27 of this app is available for Splunk Cloud.
This version of the app (1.2.2) is not available for Splunk Cloud. However, version 3.0.8Rbaf6f27 of this app is available for Splunk Cloud.
This version of the app (1.1.1) is not available for Splunk Cloud. However, version 3.0.8Rbaf6f27 of this app is available for Splunk Cloud.
This version of the app (1.1.0) is not available for Splunk Cloud. However, version 3.0.8Rbaf6f27 of this app is available for Splunk Cloud.
This version of the app (1.0.0) is not available for Splunk Cloud. However, version 3.0.8Rbaf6f27 of this app is available for Splunk Cloud.
Products: Splunk Enterprise, Splunk Cloud Products: Splunk Enterprise, Splunk Cloud Products: Splunk Enterprise, Splunk Cloud Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise, Splunk Cloud Products: Splunk Enterprise, Splunk Cloud Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise, Splunk Cloud Products: Splunk Enterprise Products: Splunk Enterprise, Splunk Cloud Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise, Splunk Cloud Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise Products: Splunk Enterprise
Splunk Versions: 9.0, 8.2, 8.1, 8.0, 7.3, 7.2, 7.1 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 7.2, 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 7.1, 7.0 Platform: Platform Independent Splunk Versions: 7.0 Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x
Licensing
Apache 2.0
Category & Contents
Categories: Security, Fraud & Compliance, Utilities
App Type: Add-on
Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Submit New Splunk App Dev Resources
PLATFORM
Data-to-Everything Platform
Splunk Cloud
Splunk Enterprise
Splunk Machine Learning Toolkit
Splunk Data Stream Processor
Pricing
Free Trials & Downloads
SECURITY PRODUCTS
Splunk Enterprise Security
Splunk Phantom
Splunk Mission Control
Splunk User Behavior Analytics
IT OPERATIONS & OBSERVABILITY PRODUCTS
Splunk Infrastructure Monitoring
Splunk IT Service Intelligence
Splunk Application Performance Monitoring
Splunk On-Call
SOLUTIONS BY INITIATIVE
Cloud Transformation
SOLUTIONS BY FUNCTION
Security
IT
Devops
SOLUTIONS BY INDUSTRY
Aerospace & Defense
Communications
Energy & Utilities
Financial Services
Healthcare
Higher Education
Manufacturing
Nonprofits
Online Services
Public Sector
Retail
WHY SPLUNK?
Why Splunk?
Customer Stories
Partners
Data-to-Everything
Diversity & Inclusion
SUPPORT
Support Portal
Support Programs
Splunk Answers
Contact Us
Product Security Updates
RESOURCES
Events
Webinars
Blogs
Customer Success
Expert Services
Data Insider
View All Resources
FOR DEVELOPERS
Documentation
Best Practices
Get Started with Splunk
Training & Certification
User Groups
Community
Splunkbase
Splunk dev
COMPANY
About Splunk
Careers
Leadership
Splunk for Good
Splunk Ventures
Splunk Protects
Newsroom
COVID-19 Response
SPLUNK SITES
.conf
Splunk Live!
T-Shirt Store
Investor Relations
Follow Us:
© 2005-2022 Splunk Inc. All rights reserved.
Sitemap | Privacy | Website Terms of Use | Splunk Licensing Terms | Export Control | Modern Slavery Statement | Splunk Patents | Report a Problem
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.