icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy
My Account
Login Signup
Support & Services
Search Splunk Documentation Splunk Answers Education & Training User Groups Splunk App Developers Support Portal Contact Us
My Account
Login Signup
Support & Services
Search Splunk Documentation Splunk Answers Education & Training User Groups Splunk App Developers Support Portal Contact Us

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Apache 2.0

Splunk Websites Terms and Conditions of Use

Thank You

Downloading SecKit Common Assets Add-on for Splunk Enterprise Security
SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_308rbaf6f27.tgz) e05aad6ceaec58f53f6efcaec467a88a807d0a32de90dd2d4be119587299eecc SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_260e1aacac.tgz) be25be4f284797fc0f8846340558ad315b0c552437920183ae4395e4662cd992 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_241rfb822c3.tgz) 9173351db41598a440c0886e12e553058d1b52b4525a95c5bf986d12f890f13c SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_240re856239.tgz) 2832e481813e95162dde57c9c8f35e4f1b912c12b72d51e744dfb6dc1bb61aef SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_228.tgz) c004e63330025ee214af96a595489af88025e83a3dfb8047f617a59bc50d3286 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_226.tgz) 83b372fb3599fd8bdbc5ee88bf7cc878607009d88df531f04475bdcefb860350 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_224.tgz) d3f2330f4bb388f59227a29db11e82695fc6cb0b3453d06b0f289d1139af76f1 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_223.tgz) 616af3a4b1188bcba8e3529c448c24baa5c10bf47feb085ec30768e082fa9a03 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_222.tgz) 3fb7c1ccbee3bb4133ae6c003a26e8130f4d06ec1717b84dc270462876727518 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_221.tgz) 47a73db4311d75e98a99cbb4c112b7f13a4f80a5f584b91cb1a8711c1e78c67f SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_210.tgz) eb9d915f59ac6bf48c5672967b91ed83a042d1b9a834ac07d4f758ec9a7fb950 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_208.tgz) 8b63bdc98e9fe0079ad9f7d99ef808c4d01bf5437d50fd067c4fd46ed809ee5c SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_206.tgz) c28ef63d00137b1748aa812d6cca592e5a4640ad86910c28deb46e1ad399086e SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_203.tgz) 7977f69781599b320e30873e35f455f439a84c0dc14e1e74d18fe972c169b00d SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_124.tgz) c7aa2fe43b09fa9432395360bd1201a7522fbaa4fd083cec21728348e39a3027 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_123.tgz) db1f2aa76c6baa05233ee309c764f6be5e7222241e75f0663a5ec873057b3637 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_122.tgz) 11d9e5f67b9c3f3f55a3ce0f06c9c8166bdf2ca53d9788e8eb19cd829fec16c3 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_111.tgz) 93190d3ed9d098f2f0035c82d8c72ea67b44826f3029e5c4cdf1e46d09110de4 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_110.tgz) e44697c8ddd86129d37da653ac73c00004d65e021c0fb9e6454db43e0dbb92b9 SHA256 checksum (seckit-common-assets-add-on-for-splunk-enterprise-security_100.tgz) 7f00fa723a4bc1175cbab4a4f68fbe8a7649558e950efe8e32e9781812294454
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

SecKit Common Assets Add-on for Splunk Enterprise Security

Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
This purpose of this Splunk Add-on is to provide foundational tools and routines for the population of assets and identities in the Enterprise Security and PCI applications for Splunk. Using this add-on develop a solid base declaration of assets with prioritization and categorization for your network.


Version 3.x is appropriate for new implementations
Version 2.x is should be updated to the latest terminal version or upgraded to 3.x

Security Kit

Identity Management Common Components

SecKit_SA_idm_common

Introduction

This purpose of this Splunk add on is to provide foundational tools and routines for the population of assets and identities in the Enterprise Security and PCI applications for Splunk.

Docs

Read The Docs
Repository

Release Notes

Version 3.0.8Rbaf6f27
Oct. 25, 2018

- Major release please read the doc https://seckit.readthedocs.io/projects/seckit-sa-idm-common
- Publishing Docs on Read the Docs
- Use of collections where possible to improve performance in SHC
- Use of first time run searches to ensure a smooth experience in Splunk Cloud
- Improved default scheduled search configuration
- Improved out of box experience "zero config" getting started
- Leveraging Splunk Enterprise Security content management for all enrichment lookups.
Version 2.6.0e1aacac
Aug. 19, 2018

-Minor updates to doc, description and naming for SplunkWorks approval process
-Add copyright to files as headers
Version 2.4.1Rfb822c3
April 18, 2018

App cert fixe
Version 2.4.0Re856239
April 17, 2018

Minor updates including code clean up and additional app certification and cloud issue resolutions
Version 2.2.8
Oct. 11, 2017

Fixed is_expected output condition to use proper syntax and resolve case issue
Version 2.2.6
July 22, 2017

Moved the release server to bintray easier to release early builds now
Fixed up some small annoyances check out commits here
https://bitbucket.org/SPLServices/seckit_sa_idm_common/commits/all
Version 2.2.4
May 11, 2017

Certification Fixes
Version 2.2.3
May 10, 2017

Bug Fixes
Version 2.2.2
Feb. 1, 2017

Fixed a ugly bug causing assets to not output
Version 2.2.1
Nov. 2, 2016

-Prevent \n from remaining in the category field
-cleanup errant | from identity fields
Version 2.1.0
Oct. 3, 2016

-Add Support for ES 4.2/4.5 multi value IP and MAC in assets
Version 2.0.8
Sept. 19, 2016

Metadata file was omited fro the latest build
Version 2.0.6
Sept. 12, 2016

Fixed missing default lookups due to changes in packaging process
Fixed missing static icons
Fixed allowing bare IP and /32 CIDRs in common output
Fixed long values missing from output of CIDR Assets
Version 2.0.3
Aug. 7, 2016

-Major release possible breaking changes verify all outputs
-Minimize duplicate/conflicting true/false values
-Support pci_domain based on static host file
-Support pci_domain based on cidr match
-Dedup and filter categories at generation time (dups will occur at search time)
-Better is_expected tracker
Version 1.2.4
March 28, 2016

Fix duplicate categories on network assets
Version 1.2.3
March 11, 2016

-Fixed issue in stream dhcp search causing unchecked lookup growth
Version 1.2.2
March 10, 2016

-Fix version string
- new saved search seckit_idm_common_stream_dhcpnetworks to automatically identify and categorize dhcp managed networks based on Splunk App for stream data.
Version 1.1.1
Feb. 21, 2016

TKO Release
-Automatic set for is_expected using meta data
Version 1.1.0
Feb. 13, 2016

* Going forward we will use categories in two formats:
- Label - traditional word or multi word strings with underscore _ separators example retired
- Sub Category "field:value" example net_type:internal
* New macros
- `seckit_idm_common_get_asset_geo` get geo fields by ip
- `seckit_idm_common_get_asset_net_category` get network categories by ip.
- `seckit_idm_common_get_asset_net_id_category` generate a net_id: category by for defined networks
- `seckit_idm_common_external_geocode` defaults to NOOP for later use with max mind database
* `seckit_idm_common_build_net_assets` enhancements
- Apply net_type:internal or net_type:external based on match to RFC subnets
- Sort the output file to ensure the most specific match is found first
Version 1.0.0
Feb. 11, 2016
388
Installs
2,258
Downloads
Share Subscribe LOGIN TO DOWNLOAD
Version
Built by
Splunk Works
Contributors
Ryan Faircloth
Support
Not Supported
Questions on Splunk Answers Flag as inappropriate
Compatibility
Splunk Versions: 8.0, 7.3, 7.2, 7.1 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 7.2, 7.1, 7.0, 6.6, 6.5 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 7.1, 7.0, 6.6, 6.5 Platform: Platform Independent Splunk Versions: 7.0, 6.6, 6.5 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.6, 6.5 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.6, 6.5, 6.4 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.6, 6.5, 6.4 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.6, 6.5, 6.4 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.5, 6.4 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.5, 6.4, 6.3, 6.2 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.5, 6.4, 6.3 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.4, 6.3 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.4, 6.3 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.4, 6.3, 6.2 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.3 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.3 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.3 Platform: Platform Independent Splunk Versions: 6.3 Platform: Platform Independent CIM Versions: 4.x Splunk Versions: 6.3 Platform: Platform Independent CIM Versions: 4.x
Licensing
Apache 2.0
Category & Contents
Categories: Security, Fraud & Compliance, Utilities
App Type: Add-on
Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Learn More

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Submit Your App Dev Resources
Follow Us:
© 2005-2020 Splunk Inc. All rights reserved.
Sitemap | Contact | Careers | Privacy | Terms of Use | Export Control | Report a Problem
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.