Last Updated
January 28, 2023
Better version of the ProtectWise TA that doesn't require the protectwise-emitter daemon Will pull in events from the Protectwise API events endpoint. Will be expanding this to pull in more from the API as time goes on. This app uses Pythons requests library alongside ConfigParser to pull Protectwise data from the ProtectWise Restful API, Thus eliminating the need to run their proprietary daemon to bring data in from the Visualizer cloud. Uses tags.conf to apply this to the IDS data model and has field aliases to alias the fields from the Protectwise API to cim fields.
(0)
Categories
Created By
Type
Downloads
Splunk Answers
Resources