Varonis DatAlert App for Splunk
Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
The Varonis DatAlert App for Splunk® enables integrating the Varonis DatAlert functionality into Splunk Enterprise. Using the app's dashboards, you can locate notable Varonis alerts directly from the Splunk user interface, and then drill down into Varonis DatAlert to get additional insights into the alert and the context in which it was generated. Additionally, the app includes field extractions that assist users in querying and visualizing Varonis alerts using Splunk Enterprise and that enable correlating the Varonis alerts with other events collected by Splunk Enterprise.
If you find any issues, use the app Splunk Answers forum or contact Varonis support.
Note: The Varonis Technology Add-On for Splunk must be installed in order for the App to pull data. Download here: https://splunkbase.splunk.com/app/4256
If you find any issues, use the app Splunk Answers forum or contact Varonis support.
Note: The Varonis Technology Add-On for Splunk must be installed in order for the App to pull data. Download here: https://splunkbase.splunk.com/app/4256
For more information, refer to the user guide or contact Varonis support.
Release Notes
Version 2.3
March 26, 2019
New for Version 2.3:
* Fixed issues identified by AppInspect:
** Removed install_source_checksum from app.conf
** Fixed permissions
Version 2.2
Nov. 14, 2018
New for Version 2.2:
* Fixed Fonts for Splunk versions <= 7.1
Version 2.1
Nov. 1, 2018
New for Version 2.1:
* Fixed URL bug (linking between dashboards)
Version 2.0
Oct. 22, 2018
New for version 2.0:
* Added support for Splunk CIM (implemented as part of the Technology Add-on)
* Moved all parsing to our Technology Add-on (which is now required install for the App to work)
* Updated App styling to match DatAlert Web UI
* Fixed display of double backslashes