Splunk Search Analyzer

[SivaPrem]

Request Type
Feature Request

Hello All,
Thanks for the good work team , and the HIVE comes very handy to use in our SOC , I saw your presentation recently on CORTEX and the possibility to have Splunk Search option in the analyzer

Would like to know in which version it was planned to be added

If available it would be very good

Merci ....................

[Status-418]

+1

[saadkadhi]

Hi @SivaPrem. We haven't gotten around to develop one yet and hopefully we'll be able to in the not-so-long term. We can't provide a date currently. We'll update the issue as soon as we can.

[BrevilleBro]

Hi,

We have developed a Splunk analyser. We will need to do some cleanup for public release, but hopefully will be able to release it in the coming week or two.

[SivaPrem]

@saadkadhi : Thank you very much , U guys rock , Missed Hack.lu / Misp Summit

[SivaPrem]

@BrevilleBro : Wow , thats amazing , Looking forward to it

[saadkadhi]

Excellent @BrevilleBro. I'll change the label to in progress.

[BrevilleBro]

Hi,

Just keeping everyone updated. We are currently preparing the analyzer for release (next day or two). We will strip it back to a 'bare-bones' Splunk Search for compatibility, however, if anyone wants an example/release of a more environment specific Splunk Search (i.e., proxy logs), please let me know.

[SivaPrem]

@BrevilleBro : Perfect , thats good news !!!!! search on proxy logs will be amazing to have it !!!!!

[BrevilleBro]

Hi,

We have released our Splunk analyser. @SivaPrem , let us know if you encounter any issues :)
https://github.com/UNIT777/Cortex-Analyzers/tree/Splunk

I have included a generic template/analyzer template, as well as more specific ones (although they may need to be customised to your environment).