Bitglass App built by Bitglass

Overview

This app will be used to pull Bitglass logs using REST API and populate it into Splunk visualizing the log data.

It supports the following Bitglass log sources: Access, Admin, Cloudaudit. The https proxy setting is supported for log retrieval. The authentication type is either Basic or OAuth 2.0

Release Notes

Version 1.0.14

June 13, 2022

Changes from 1.0.13 to 1.0.14:

Support Splunk 9.0
Drop Python 2 support (Splunk 7.3.3 support is dropped)
Support saving the log stream context to a variable for platforms where File I/O is not available
Improve some log messages including the ones for log stream context reset
Fix parsing the syslog sink destination
Minor bug fixes (including ESLint, flake8 and other static code scanners' warnings and exceptions)
Code refactoring and cleanups

Version 1.0.13

Oct. 20, 2021

Changes from 1.0.11 to 1.0.13:

Use Bitglass API version 1.1.5 by default
Add healthproxy, healthapi and healthsystem log types
Support Splunk 8.2.2
Switch to using JQuery 3.5
Fixed drilldown links in some widgets
Other minor bug fixes

Version 1.0.11

April 15, 2021

Changes from 1.0.9 to 1.0.11:

'Rewind Logs' option to re-ingest the logs starting from 30 days ago (resets lastlog-*.json files)
Fix logs hold up when the very first request after launching the app for the first time fails

Version 1.0.9

March 3, 2021

Changes from 1.0.8 to 1.0.9:

Use Bitglass API version 1.1.0 by default
Add swgweb and swgwebdlp log types
Add the option to override the default index 'main' (manual steps are still required, please see README.txt)
Test and support the Redhat distro in addition to Ubuntu
Split the lastlog.json file into multiple lastlog-<log type>.json files with added ingestion time and last status for better diagnostics
Fix occasional multiple events lumped into one due to triggering the default multiline merging logic in Splunk by adding the props.conf file with SHOULD_LINEMERGE = false
Fix the "Top 10 Devices" widget for the swgweb log type
Fix Bandit and ESLint security warnings (no actual problems were found)

Version 1.0.8

Nov. 9, 2020

Changes from 1.0.6 to 1.0.8:

Fix Splunk cloud certification report issues: potential file access outside of the app folder; changed the log file location to var/log/splunk; disable unmasking token and password input fields; mask the proxy data as it may contain a password
Add authorize_sample.conf and indexes_sample.conf
Display the app version and the latest supported Bitglass API version
Support the latest Splunk 7.2 version (7.2.10.1) that still uses Python 2 only
Add Logging Interval setting
Fix errors logged to the Splunk index

Troubleshooting tips and known issues:

In some browsers, after submitting the app configuration settings form, you may be prompted repeatedly to configure the app again. In such case, restart the Splunk instance and the app widget screen should show up normally
The app logs are available in $SPLUNK_HOME/var/log/splunk/bitglass.log
The Splunk logs are available in $SPLUNK_HOME/var/log/splunk/splunkd.log

Version 1.0.6

Oct. 2, 2020

Changes from 1.0.4 to 1.0.6:

Store OAuth 2.0 token encrypted in passwords.conf
Fix AppInspect warnings
Fix js errors in the setup page on connection failure
Cosmetic updates to the setup page
Added support for Bitglass API versions 1.0.8 and 1.0.9
Added Policy ID widget
Bug fixes
Initial data import is increased from 7 to 30 days

Version 1.0.4

Sept. 11, 2020

Fix DEBUG logging and print extra
Load extra json configuration from default/ since local/ doesn't exist on freshly installed app
Move log/app.log to default/ from local/ for the same reason above
Add missing requests_oauth2 python lib to bin/
Rename default/.setup.xml to setup-old.xml (fallback) so it's not removed by the addon builder
Update the new-style setup page

616

Downloads

Share Subscribe

Version

Built by

ben rice

Support

Developer Supported

Contact Developer Questions on Splunk Answers Flag as inappropriate

Compatibility

This version of the app (1.0.11) is not available for Splunk Cloud. However, version 1.0.14 of this app is available for Splunk Cloud.

This version of the app (1.0.9) is not available for Splunk Cloud. However, version 1.0.14 of this app is available for Splunk Cloud.

This version of the app (1.0.8) is not available for Splunk Cloud. However, version 1.0.14 of this app is available for Splunk Cloud.

This version of the app (1.0.6) is not available for Splunk Cloud. However, version 1.0.14 of this app is available for Splunk Cloud.

This version of the app (1.0.4) is not available for Splunk Cloud. However, version 1.0.14 of this app is available for Splunk Cloud.

Products: Splunk Enterprise, Splunk Cloud

Products: Splunk Enterprise

Splunk Versions: 9.0, 8.2, 8.1, 8.0