Hurricane Labs Add-On for Blue Coat Console
This app has been archived. Learn more about app archiving.
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
This add-on provides field extractions and CIM compatibility for the Blue Coat ProxySG Console logs. Splunk users with Blue Coat proxies can use this to feed into Enterprise Security events relating to Authentication and Change Analysis for the proxy itself. This add-on does not support the proxy access logs already supported by the Splunk-built Blue Coat TA.
OVERVIEW
About the TA-bluecoat_console
| Author | Brian T Glenn brian@hurricanelabs.com |
|---|---|
| App Version | 1.0 |
| Vendor Products | Bluecoat ProxySG 5.x and 6.x Console Messages |
| Has index-time operations | <true> |
| Create an index | <false> |
| Implements summarization | <false> |
The TA-bluecoat_console allows a Splunk® Enterprise administrator to get field extractions
for the console and system messages of the proxy, supplying data to both the Authentication
and Change Analysis datamodels.
Release Notes
Version 1.0.1
July 1, 2020
Thank you to Chris Bell for additional field extractions!
Version 1.0
June 14, 2017