icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy
My Account
Login Signup
Support & Services
Search Splunk Documentation Splunk Answers Education & Training User Groups Splunk App Developers Support Portal Contact Us
My Account
Login Signup
Support & Services
Search Splunk Documentation Splunk Answers Education & Training User Groups Splunk App Developers Support Portal Contact Us

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

MIT

Splunk Websites Terms and Conditions of Use

Thank You

Downloading Linux Secure Technology Add-On
SHA256 checksum (linux-secure-technology-add-on_100.tgz) a909d66adec8cdd274a8df490bc4691612a9acc8c42f575b597001c69ac132b3 SHA256 checksum (linux-secure-technology-add-on_013.tgz) 61d781f84c30be4246ef41870b91b62b0ba13aa3987079d4e30451216fe50994
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Linux Secure Technology Add-On

Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
This app provides field extractions and normalisation to the Common Information Model for /var/log/secure and /var/log/auth.log (linux_secure sourcetype). It is intended to replace the security-relevant aspects of the Splunk Add-on for Unix and Linux (Splunk_TA_nix) and as such it's strongly recommended that the Splunk_TA_nix app be removed from your search head before installing this app as they may conflict. This app requires no configuration and need only be installed on search heads (i.e. contains no index-time transforms).

Be sure to also check out the certified sudo (https://splunkbase.splunk.com/app/3038/), iptables (https://splunkbase.splunk.com/app/3089/) and auditd (https://splunkbase.splunk.com/app/2642/) apps.

For Linux performance monitoring, please see: https://splunkbase.splunk.com/app/3412/

This app provides linux_secure field extractions and normalisation to the Common Information Model.

Simply install this app on your search head (no configuration required).

Further documentation is provided in the wiki here: https://github.com/doksu/TA-linux_secure/wiki

May this app improve the security of organisations great and small.

Release Notes

Version 1.0.0
Aug. 8, 2019

Bug Fixes:
- src_ip not extracted in recent versions of Splunk due to changes in how FIELDALIASing works (Thanks Martin Mueller for the fix and Paul + Rolf who reported the bug: https://github.com/doksu/TA-linux_secure/issues/1)
Version 0.1.3
May 25, 2018

Improvements:
- Support for a wider range of events
- Support for Debian-based distributions' log formatting
- Unnecessary regex capture groups in some field extractions replaced with non-capture groups
844
Installs
3,131
Downloads
Share Subscribe LOGIN TO DOWNLOAD
Version
This version has not passed Splunk AppInspect.
This version has not passed Splunk AppInspect.
This version has not passed Splunk AppInspect.
Built by
Doug Brown
Support
Not Supported
Questions on Splunk Answers Flag as inappropriate
Compatibility
This version is not yet available for Splunk Cloud.
Products: Splunk Enterprise Products: Splunk Enterprise, Splunk Cloud
Splunk Versions: 8.1, 8.0, 7.3, 7.2, 7.1, 7.0 Platform: Platform Independent CIM Versions: 4.x Platform: Platform Independent CIM Versions: 4.x
Licensing
MIT
Category & Contents
Categories: Security, Fraud & Compliance
App Type: Add-on
Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Learn More

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Submit Your App Dev Resources
Follow Us:
© 2005-2020 Splunk Inc. All rights reserved.
Sitemap | Contact | Careers | Privacy | Terms of Use | Export Control | Report a Problem
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.