Linux Secure Technology Add-On

Overview

Details

This app provides field extractions and normalisation to the Common Information Model for /var/log/secure and /var/log/auth.log (linux_secure sourcetype). It is intended to replace the security-relevant aspects of the Splunk Add-on for Unix and Linux (Splunk_TA_nix) and as such it's strongly recommended that the Splunk_TA_nix app be removed from your search head before installing this app as they may conflict. This app requires no configuration and need only be installed on search heads (i.e. contains no index-time transforms).

Be sure to also check out the certified sudo (https://splunkbase.splunk.com/app/3038/), iptables (https://splunkbase.splunk.com/app/3089/) and auditd (https://splunkbase.splunk.com/app/2642/) apps.

For Linux performance monitoring, please see: https://splunkbase.splunk.com/app/3412/

This app provides linux_secure field extractions and normalisation to the Common Information Model.

Simply install this app on your search head (no configuration required).

Further documentation is provided in the wiki here: https://github.com/doksu/TA-linux_secure/wiki

May this app improve the security of organisations great and small.

Release Notes

Version 1.0.1

Nov. 29, 2021

Improvements:
- Eventtypes updated to prevent warning about wildcards in the middle of a string (this is not listed as a bug because it did not actually negative impact search results)

Version 1.0.0

Aug. 8, 2019

Bug Fixes:
- src_ip not extracted in recent versions of Splunk due to changes in how FIELDALIASing works (Thanks Martin Mueller for the fix and Paul + Rolf who reported the bug: https://github.com/doksu/TA-linux_secure/issues/1)

Version 0.1.3

May 25, 2018

Improvements:
- Support for a wider range of events
- Support for Debian-based distributions' log formatting
- Unnecessary regex capture groups in some field extractions replaced with non-capture groups

4,677

Downloads

Share Subscribe

Version

Built by

Doug Brown

Support

Not Supported

Questions on Splunk Answers Flag as inappropriate

Compatibility

Products: Splunk Enterprise, Splunk Cloud

Splunk Versions: 9.0, 8.2, 8.1, 8.0, 7.3, 7.2

Platform: Platform Independent

CIM Versions: 4.x, 3.x

Splunk Versions: 9.0, 8.2, 8.1, 8.0, 7.3, 7.2, 7.1, 7.0

Platform: Platform Independent

CIM Versions: 4.x

Splunk Versions: 7.3, 7.2

Platform: Platform Independent

CIM Versions: 4.x

Licensing

MIT

Category & Contents

Categories: Security, Fraud & Compliance

App Type: Add-on

Subscribe Share

My Account

Support & Services