Harpoon Security
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
This TA enables rapid acquisition and parsing of Harpoon Security Event logs and provides integrations into Enterprise Security as well as workflows to enable pivoting and aggregation from other CIM compliant data sources.
This app require Common Information Model (https://splunkbase.splunk.com/app/1621/) installed and configured for worflow functionality
Memory Injection correlation search must be enabled within Enterprise Security for generation of notable events.
This app require Common Information Model (https://splunkbase.splunk.com/app/1621/) installed and configured for worflow functionality
Memory Injection correlation search must be enabled within Enterprise Security for generation of notable events.
- This app requires Common Information Model App installed and configured (https://splunkbase.splunk.com/app/1621/) for workflows to identify indexes and populate.
- Memory Injection correlation search must be enabled from within Enterprise Security to generate notable events.
Release Notes
Version 1.0.0
May 25, 2020
Initial Release of Splunk App for Harpoon Security. App should is applicable for install on search heads, indexers, and forwarders.
This app is CIM compliant and mapped to Change, Endpoint, Intrusion Detection, and Malware datamodels.
This app is Enterprise Security Compliant and generates notable events of process injection at endpoints.