Inky HEC Add-on for Splunk

Overview

Details

### Description ###
The purpose of this add-on is to provide CIM compliant field extractions for Inky logs via HEC.

+Built for Splunk Enterprise 6.x.x or higher
+CIM Compliant (CIM 4.0.0 or higher)
+Ready for Enterprise Security

Add-on Homepage:
Author: Hurricane Labs
Version: 1.0.0

Description

The purpose of this add-on is to provide CIM compliant field extractions for Inky logs via HEC.

+Built for Splunk Enterprise 6.x.x or higher
+CIM Compliant (CIM 4.0.0 or higher)
+Ready for Enterprise Security

INSTALLATION AND CONFIGURATION

Search Head: Required
Heavy Forwarder: Possibly Required
Indexer: Possibly Required
Universal Forwarder: Not Supported
Light Forwarder: Not Supported

Add-on Installation

Install on your Search Head and HEC Endpoint.
Splunk restart may be required depending on your version of Splunk.

Setting up the HEC Token (GUI)

Settings > Data Inputs > HTTP Event Collector > New Token.
Set a name for the input (up to you) and leave "Enable indexer acknowledgment" unchecked, click next.
For "source type" click "select" and choose "inky:email:hec", then at the bottom select the index you want to store the logs in. Review and finish.

Setting up HEC Token (CLI)

Change the index and token value and set this in inputs.conf on your HEC collection point(s).
Note: You can run 'uuidgen' to generate a HEC token value from Linux/Mac

[http://inky]
description = Inky Events
disabled = 0
index = <REPLACEME>
indexes = <REPLACEME>
useACK = 0
token = <REPLACEME>
sourcetype = inky:email:hec

Validate your installation

Search for the data on your Search Head by running this search (smart/verbose mode):
a. index=REPLACEME sourcetype=inky:email:hec
On the left hand side, verify that you see the auto KV json fields (such as data.meta_data.dashboard_url, etc)
On the left hand side, verify that you see CIM fields (such as recipient, subject, etc)

New features

1.0.0: Add-on released

Fixed issues

Known issues

DEV SUPPORT

Contact: splunk-app@hurricanelabs.com

Release Notes

Version 1.0.0

May 28, 2020

162

Downloads

Share Subscribe

Version

Built by

Hurricane Labs

Support

Developer Supported

Contact Developer Questions on Splunk Answers Flag as inappropriate

Compatibility

Products: Splunk Enterprise, Splunk Cloud

Splunk Versions: 7.0, 7.1, 7.2, 7.3, 8.0, 8.1, 8.2

Platform: Platform Independent

CIM Versions: 4.x

Licensing

End User License Agreement for Third-Party Content

Category & Contents

Categories: IT Operations, Security, Fraud & Compliance

App Type: Add-on

Subscribe Share

My Account

Support & Services