This Certificates Expiry Add-on for Splunk allows a Splunk® Enterprise
or Splunk Cloud administrator to collect data from hostnames or FQDN. The add-on
collects the certificate but records minimal detail from the certificate.
The Add-on is built with Splunk AOB (Add-on Builder) and minimalist viewpoint.
Aim is just enough field data to raise alerts to appropriate teams or administrators that
a certificate is approaching expiration and requires renewal. Use it to monitor certificates
for splunk forwarders and indexers for eg. indexer01:9996
The fields collected by the add-on are:
example event
date=01/06/2022 11:42:45 fqdn=splunk.com port=443 expiredays=181 issuer="DigiCert Inc" commonName="DigiCert TLS RSA SHA256 2020 CA1" use_proxy=True notAfter="Nov 29 23:59:59 2022 GMT" notBefore="Nov 29 00:00:00 2021 GMT"
No components are required on Searchhead or Searchhead Clusters
Install this TA on a HF (Heavy Forwarder) and configure inputs using a proxy or not
Proxy:
The proxy implementation is limited at this time, http transparent proxy only. No authentication to the proxy is performed in this version.
Debug log level:
Can be used if set
Interval:
defaults to 12h or 43200 seconds which is probably enough data for raising alerts
Internal Index info:
use the internal index for information on inputs
Internal Index
index=_internal sourcetype="tacertificatesexpiry:log"
Example Search
sourcetype=ssl_cert | stats last(issuer) as Issuer last(commonName) as commonName last(expiredays) as "Days Left" by fqdn | rename fqdn as "Domain / Hostname"
Example Alert search
sourcetype=ssl_cert | stats last(issuer) as Issuer last(commonName) as commonName last(expiredays) as "Days Left" by fqdn | rename fqdn as "Domain / Hostname" | where tonumber('Days Left') < 30
none
This Certificates Expiry Add-on for Splunk allows a Splunk® Enterprise
or Splunk Cloud administrator to collect data from hostnames or FQDN. The add-on
collects the certificate but records minimal detail from the certificate.
The Add-on is built with Splunk AOB (Add-on Builder) and minimalist viewpoint.
Aim is just enough field data to raise alerts to appropriate teams or administrators that
a certificate is approaching expiration and requires renewal. Use it to monitor certificates
for splunk forwarders and indexers for eg. indexer01:9996
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.