icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading BlueCat DNS Edge for Splunk
SHA256 checksum (bluecat-dns-edge-for-splunk_135.tgz) b43f145e8b49023b21fe407babfda08057c5e6997141a06a33906e4e8ac77011 SHA256 checksum (bluecat-dns-edge-for-splunk_133.tgz) 65c49c9552455d0e2258d16023d3cce7b92cc3eb8a50df4c4436f897bbf51f63 SHA256 checksum (bluecat-dns-edge-for-splunk_132.tgz) 2483e1486a0ced5ac9c697a3e9d0e633996a4ab24fb77da1b72f0f52a040cda5 SHA256 checksum (bluecat-dns-edge-for-splunk_131.tgz) fae89100dfb7c07b20f08de7e86af55308eebb6c77b501ebee6547c7717860b9 SHA256 checksum (bluecat-dns-edge-for-splunk_130.tgz) 715fbd03e01fb6ec7b9e95d516746a12fc9e98550a0dc91204fed29dd1d4340c SHA256 checksum (bluecat-dns-edge-for-splunk_121.tgz) 346d202b290a086385f10f4948157256717c69a24dd0a563c63c5500f3cc639e SHA256 checksum (bluecat-dns-edge-for-splunk_12.tgz) 69fbb47feda5c841e3916edbe81ab8caf1edce442dc4cbc03bb323b006e0e939 SHA256 checksum (bluecat-dns-edge-for-splunk_11.tgz) db0c0a5f18946ffecce24123e6e387b99ebfe55d40f848dece67ee517c518439 SHA256 checksum (bluecat-dns-edge-for-splunk_10.tgz) b653e950de1efd138c1faa365fc054e0fc51f30831c01084800836c5a6e3a974
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

splunk

BlueCat DNS Edge for Splunk

Splunk Cloud
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
BlueCat DNS Edge is a cloud-based, client-facing firewall that leverages an organization’s existing DNS data and infrastructure to provide visibility, control, and cyber threat detection capabilities to an organization.

Cybersecurity analysts use the BlueCat DNS Edge for Splunk app to easily review, monitor and set alerts on security policy events from their BlueCat DNS Edge service points. A simple search interface and alert framework within the app make it easy for security professionals and DNS administrators to explore data and configure notifications to fit workflow preferences. Enable this app with data provided by the BlueCat DNS Edge Technical Add-On for Splunk modular input provided here https://splunkbase.splunk.com/app/3816/.

OVERVIEW

About BlueCat DNS Edge for Splunk

Author BlueCat
App Version 1.3.0
Vendor Products BlueCat DNS Edge
Has index-time operations false
Create an index false
Implements summarization false

The BlueCat DNS Edge for Splunk app provides basic visualizations and alerts for BlueCat DNS Edge API data. This app is intended to work with data provided by the BlueCat DNS Edge Technical Add-on for Splunk modular input (link). This app provides a simple search interface and alert framework for DNS administrators and security professionals to review, monitor, and alert on policy events from their BlueCat DNS Edge service points.

Scripts and binaries

No scripts or binaries included.

Release notes

About this release

Version 1.3.0 of BlueCat DNS Edge for Splunk is compatible with:

Splunk Enterprise versions 7.0
CIM 4.9.1
Platforms Platform independent
Vendor Products BlueCat DNS Edge
Lookup file changes Initial lookup creation
New features

BlueCat DNS Edge for Splunk includes the following new features:

  • Search and alert on policy events reported by BlueCat DNS Edge server
Fixed issues

Version 1.3.0 of BlueCat DNS Edge for Splunk fixes the following issues:

  • N/A initial release
Known issues

Version 1.3.0 of BlueCat DNS Edge for Splunk has the following known issues:

  • N/A initial release
Third-party software attributions

Version 1.3.0 of BlueCat DNS Edge for Splunk incorporates the following third-party software or libraries.

  • N/A

Performance benchmarks

BlueCat DNS Edge for Splunk has been tested on standalone Splunk instances that meet the minimum reference hardware specifications. Impact of search queries varies depending on amount of policy events being collected and time range searched over.

Support and resources

Questions and answers

General Splunk troubleshooting advice can be found on answers.splunk.com

Support

Please contact edge-splunk@bluecatnetworks.com for support.

INSTALLATION AND CONFIGURATION

Hardware and software requirements

Hardware requirements

BlueCat DNS Edge for Splunk can be installed on any server that meets the Splunk reference hardware specifications.

Software requirements

BlueCat DNS Edge for Splunk does not require any additional software.

Splunk Enterprise system requirements

Because this app runs on Splunk Enterprise, all of the Splunk Enterprise system requirements apply.

Download

Download BlueCat DNS Edge for Splunk from Splunkbase

Installation steps

BlueCat DNS Edge for Splunk is only required on Splunk Search Heads and should be installed alongside the BlueCat DNS Edge Technical Add-on for Splunk. BlueCat DNS Edge for Splunk relies on data collected by the BlueCat DNS Edge Technical Add-on for Splunk. Install the TA as per the included instructions, configure inputs, and verify data is flowing into Splunk successfully before using this app.

To install and configure this app on your Splunk Search Head, follow these steps:

  1. Download BlueCat DNS Edge for Splunk from Splunkbase.
  2. Login to Splunk with an administrator account (default: admin).
  3. Click the "Apps" dropdown in the upper left corner of the screen and select "Manage Apps".
  4. Select "Install app from file", click "Choose file", navigate to the app package downloaded in the previous step, and click "Upload".
  5. Splunk must be restarted to reload app icons, otherwise the app is completely functional without a restart.

USER GUIDE

Return to the Splunk Home page and select "BlueCat DNS Edge for Splunk". On this page you can review Policy Event details. The "Policies" dropdown will not work until there is Policy Detail data and a lookup has been generated. To generate a Policy Details lookup table quickly, simply visit the "Policy Details" page. On this page you can review details about individual policies.

On the Policy Alerts page, users can select policy events they wish to be alerted about. Select a policy, select whether to enable or disable the policy, and click Submit. To modify the settings for this alert, navigate to Settings > Searches, Reports, and Alerts > BlueCat DNS Edge - Policy Alerts. There users can configure alert actions (email, ticket, scripts, etc.) and modify the alert schedule.

Data types

This app is used to analyze data collected with the BlueCat DNS Edge Technical Add-on for Splunk. Knowledge objects for BlueCat DNS Edge data are defined in the technical add-on which should also be installed on the saerch head.

Lookups

BlueCat DNS Edge for Splunk contains 2 lookup files.

Lookupname

bluecat_dns_edge_policies - A table of policies defined on BlueCat DNS Edge service points.

bluecat_dns_edge_policy_alerts - A table of policies defining which will actively be alerted on by Splunk.

Configure BlueCat DNS Edge for Splunk

After selecting which policies to alert on, make sure to enable the saved search BlueCat DNS Edge - Policy Alerts in the Searches, Reports, and Alerts menu.

Troubleshoot BlueCat DNS Edge for Splunk

Verify the lookup table bluecat_dns_edge_policy_alerts.csv has active alerts (the "Alerts" column will say "Active" for a given policy) - | inputlookup bluecat_dns_edge_policy_alerts

Verify the Saved Search "BlueCat DNS Edge - Policy Alerts" is enabled

Verify email settings are configured on this Splunk server and the "BlueCat DNS Edge - Policy Alerts" search is configured with email as an alert action

Upgrade BlueCat DNS Edge for Splunk

Simply follow the same steps listed in "Installation Steps" but make sure the checkbox for "upgrade" is selected.

Example Use Case

Search for DNS policy events on the "Policy Events" dashboard (e.g. DNS events from specific sources)
Receive email alerts for specific policy event triggers (e.g. blacklisted domains).

Release Notes

Version 1.3.5
Sept. 2, 2021
Version 1.3.3
April 22, 2021
Version 1.3.2
May 11, 2020
Version 1.3.1
June 12, 2019
Version 1.3.0
May 11, 2018
Version 1.2.1
April 30, 2018
Version 1.2
April 27, 2018
Version 1.1
Jan. 18, 2018
Version 1.0
Dec. 9, 2017

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.