icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading BlueCat DNS Edge for Splunk
SHA256 checksum (bluecat-dns-edge-for-splunk_131.tgz) fae89100dfb7c07b20f08de7e86af55308eebb6c77b501ebee6547c7717860b9 SHA256 checksum (bluecat-dns-edge-for-splunk_130.tgz) 715fbd03e01fb6ec7b9e95d516746a12fc9e98550a0dc91204fed29dd1d4340c SHA256 checksum (bluecat-dns-edge-for-splunk_121.tgz) 346d202b290a086385f10f4948157256717c69a24dd0a563c63c5500f3cc639e SHA256 checksum (bluecat-dns-edge-for-splunk_12.tgz) 69fbb47feda5c841e3916edbe81ab8caf1edce442dc4cbc03bb323b006e0e939 SHA256 checksum (bluecat-dns-edge-for-splunk_11.tgz) db0c0a5f18946ffecce24123e6e387b99ebfe55d40f848dece67ee517c518439 SHA256 checksum (bluecat-dns-edge-for-splunk_10.tgz) b653e950de1efd138c1faa365fc054e0fc51f30831c01084800836c5a6e3a974
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

BlueCat DNS Edge for Splunk

Splunk AppInspect Passed
Overview
Details
BlueCat DNS Edge is a cloud-based, client-facing firewall that leverages an organization’s existing DNS data and infrastructure to provide visibility, control, and cyber threat detection capabilities to an organization.

Cybersecurity analysts use the BlueCat DNS Edge for Splunk app to easily review, monitor and set alerts on security policy events from their BlueCat DNS Edge service points. A simple search interface and alert framework within the app make it easy for security professionals and DNS administrators to explore data and configure notifications to fit workflow preferences. Enable this app with data provided by the BlueCat DNS Edge Technical Add-On for Splunk modular input provided here https://splunkbase.splunk.com/app/3816/.

OVERVIEW

About BlueCat DNS Edge for Splunk

Author BlueCat
App Version 1.3.0
Vendor Products BlueCat DNS Edge
Has index-time operations false
Create an index false
Implements summarization false

The BlueCat DNS Edge for Splunk app provides basic visualizations and alerts for BlueCat DNS Edge API data. This app is intended to work with data provided by the BlueCat DNS Edge Technical Add-on for Splunk modular input (link). This app provides a simple search interface and alert framework for DNS administrators and security professionals to review, monitor, and alert on policy events from their BlueCat DNS Edge service points.

Scripts and binaries

No scripts or binaries included.

Release notes

About this release

Version 1.3.0 of BlueCat DNS Edge for Splunk is compatible with:

Splunk Enterprise versions 7.0
CIM 4.9.1
Platforms Platform independent
Vendor Products BlueCat DNS Edge
Lookup file changes Initial lookup creation
New features

BlueCat DNS Edge for Splunk includes the following new features:

  • Search and alert on policy events reported by BlueCat DNS Edge server
Fixed issues

Version 1.3.0 of BlueCat DNS Edge for Splunk fixes the following issues:

  • N/A initial release
Known issues

Version 1.3.0 of BlueCat DNS Edge for Splunk has the following known issues:

  • N/A initial release
Third-party software attributions

Version 1.3.0 of BlueCat DNS Edge for Splunk incorporates the following third-party software or libraries.

  • N/A

Performance benchmarks

BlueCat DNS Edge for Splunk has been tested on standalone Splunk instances that meet the minimum reference hardware specifications. Impact of search queries varies depending on amount of policy events being collected and time range searched over.

Support and resources

Questions and answers

General Splunk troubleshooting advice can be found on answers.splunk.com

Support

Please contact edge-splunk@bluecatnetworks.com for support.

INSTALLATION AND CONFIGURATION

Hardware and software requirements

Hardware requirements

BlueCat DNS Edge for Splunk can be installed on any server that meets the Splunk reference hardware specifications.

Software requirements

BlueCat DNS Edge for Splunk does not require any additional software.

Splunk Enterprise system requirements

Because this app runs on Splunk Enterprise, all of the Splunk Enterprise system requirements apply.

Download

Download BlueCat DNS Edge for Splunk from Splunkbase

Installation steps

BlueCat DNS Edge for Splunk is only required on Splunk Search Heads and should be installed alongside the BlueCat DNS Edge Technical Add-on for Splunk. BlueCat DNS Edge for Splunk relies on data collected by the BlueCat DNS Edge Technical Add-on for Splunk. Install the TA as per the included instructions, configure inputs, and verify data is flowing into Splunk successfully before using this app.

To install and configure this app on your Splunk Search Head, follow these steps:

  1. Download BlueCat DNS Edge for Splunk from Splunkbase.
  2. Login to Splunk with an administrator account (default: admin).
  3. Click the "Apps" dropdown in the upper left corner of the screen and select "Manage Apps".
  4. Select "Install app from file", click "Choose file", navigate to the app package downloaded in the previous step, and click "Upload".
  5. Splunk must be restarted to reload app icons, otherwise the app is completely functional without a restart.

USER GUIDE

Return to the Splunk Home page and select "BlueCat DNS Edge for Splunk". On this page you can review Policy Event details. The "Policies" dropdown will not work until there is Policy Detail data and a lookup has been generated. To generate a Policy Details lookup table quickly, simply visit the "Policy Details" page. On this page you can review details about individual policies.

On the Policy Alerts page, users can select policy events they wish to be alerted about. Select a policy, select whether to enable or disable the policy, and click Submit. To modify the settings for this alert, navigate to Settings > Searches, Reports, and Alerts > BlueCat DNS Edge - Policy Alerts. There users can configure alert actions (email, ticket, scripts, etc.) and modify the alert schedule.

Data types

This app is used to analyze data collected with the BlueCat DNS Edge Technical Add-on for Splunk. Knowledge objects for BlueCat DNS Edge data are defined in the technical add-on which should also be installed on the saerch head.

Lookups

BlueCat DNS Edge for Splunk contains 2 lookup files.

Lookupname

bluecat_dns_edge_policies - A table of policies defined on BlueCat DNS Edge service points.

bluecat_dns_edge_policy_alerts - A table of policies defining which will actively be alerted on by Splunk.

Configure BlueCat DNS Edge for Splunk

After selecting which policies to alert on, make sure to enable the saved search BlueCat DNS Edge - Policy Alerts in the Searches, Reports, and Alerts menu.

Troubleshoot BlueCat DNS Edge for Splunk

Verify the lookup table bluecat_dns_edge_policy_alerts.csv has active alerts (the "Alerts" column will say "Active" for a given policy) - | inputlookup bluecat_dns_edge_policy_alerts

Verify the Saved Search "BlueCat DNS Edge - Policy Alerts" is enabled

Verify email settings are configured on this Splunk server and the "BlueCat DNS Edge - Policy Alerts" search is configured with email as an alert action

Upgrade BlueCat DNS Edge for Splunk

Simply follow the same steps listed in "Installation Steps" but make sure the checkbox for "upgrade" is selected.

Example Use Case

Search for DNS policy events on the "Policy Events" dashboard (e.g. DNS events from specific sources)
Receive email alerts for specific policy event triggers (e.g. blacklisted domains).

Release Notes

Version 1.3.1
June 12, 2019

Version 1.3.0
May 11, 2018

Version 1.2.1
April 30, 2018

Version 1.2
April 27, 2018

Version 1.1
Jan. 18, 2018

Version 1.0
Dec. 9, 2017

31
Installs
266
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2019 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.