Linux Secure Technology Add-On
Overview
Details
Be sure to also check out the certified sudo (https://splunkbase.splunk.com/app/3038/), iptables (https://splunkbase.splunk.com/app/3089/) and auditd (https://splunkbase.splunk.com/app/2642/) apps.
For Linux performance monitoring, please see: https://splunkbase.splunk.com/app/3412/
This app provides linux_secure field extractions and normalisation to the Common Information Model.
Simply install this app on your search head (no configuration required).
Further documentation is provided in the wiki here: https://github.com/doksu/TA-linux_secure/wiki
May this app improve the security of organisations great and small.
Release Notes
Version 1.0.1
Improvements:
- Eventtypes updated to prevent warning about wildcards in the middle of a string (this is not listed as a bug because it did not actually negative impact search results)
Version 1.0.0
Bug Fixes:
- src_ip not extracted in recent versions of Splunk due to changes in how FIELDALIASing works (Thanks Martin Mueller for the fix and Paul + Rolf who reported the bug: https://github.com/doksu/TA-linux_secure/issues/1)
Version 0.1.3
Improvements:
- Support for a wider range of events
- Support for Debian-based distributions' log formatting
- Unnecessary regex capture groups in some field extractions replaced with non-capture groups