CCX Unified Splunk Add-on for Citrix
Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
About Us:
CyberCX is Australia’s greatest force of cyber security experts. Our highly skilled professional services team operates a 24x7 on-shore security operations centre (SOC) servicing corporate and public sector organisations across Australia and New Zealand, specialising in Security Operations services leveraging Splunk.
Description:
The CCX Unified Splunk Add-On for Citrix looks to provide a single field extraction bundle for Citrix Systems.
This TA was built using a large dataset and endeavours to be the most CIM compliant comprehensive field extraction TA avaliable for;
- Citrix Systems - Syslog
Fully compatible with Splunk Enterprise and Splunk Cloud, built by an Ops team for Ops teams.
Features:
- This TA currently supports logtypes tagged under the following CIM datamodels: Network Traffic, Authentication, Inventory.
CyberCX is Australia’s greatest force of cyber security experts. Our highly skilled professional services team operates a 24x7 on-shore security operations centre (SOC) servicing corporate and public sector organisations across Australia and New Zealand, specialising in Security Operations services leveraging Splunk.
Description:
The CCX Unified Splunk Add-On for Citrix looks to provide a single field extraction bundle for Citrix Systems.
This TA was built using a large dataset and endeavours to be the most CIM compliant comprehensive field extraction TA avaliable for;
- Citrix Systems - Syslog
Fully compatible with Splunk Enterprise and Splunk Cloud, built by an Ops team for Ops teams.
Features:
- This TA currently supports logtypes tagged under the following CIM datamodels: Network Traffic, Authentication, Inventory.
Release Notes
Version 1.2.2
Jan. 6, 2021
Requirements:
- This Add-On is intended to be installed on Heavy Forwarders and Search Heads.
Installation:
- This Add-On is intended to be installed on Heavy Forwarders and Search Heads.
- Is recommended to use separate index per Citrix Systems technology.
Known issues:
- (none)
Addressed Issues:
- Revised REGEX extractions
- Additional and revised CIM fields
- Included by default TIME_PREFIX configuration to minimize issues with event timestamp extraction.