From 360a91ebbb960dc7f1c6d1f69812d556469c0061 Mon Sep 17 00:00:00 2001 From: research-bot Date: Wed, 18 Dec 2024 13:32:03 -0800 Subject: [PATCH 1/3] remove index --- macros/f5_bigip_rogue.yml | 2 +- macros/zeek_rpc.yml | 2 +- macros/zeek_ssl.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/macros/f5_bigip_rogue.yml b/macros/f5_bigip_rogue.yml index 4c80756aaa..2fab5f6d64 100644 --- a/macros/f5_bigip_rogue.yml +++ b/macros/f5_bigip_rogue.yml @@ -1,4 +1,4 @@ -definition: index=netops sourcetype="f5:bigip:rogue" +definition: sourcetype="f5:bigip:rogue" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. name: f5_bigip_rogue \ No newline at end of file diff --git a/macros/zeek_rpc.yml b/macros/zeek_rpc.yml index 373581dceb..f4c6dadea0 100644 --- a/macros/zeek_rpc.yml +++ b/macros/zeek_rpc.yml @@ -1,4 +1,4 @@ -definition: index=zeek sourcetype="zeek:rpc:json" +definition: sourcetype="zeek:rpc:json" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. name: zeek_rpc diff --git a/macros/zeek_ssl.yml b/macros/zeek_ssl.yml index 258e60a703..8d613468cf 100644 --- a/macros/zeek_ssl.yml +++ b/macros/zeek_ssl.yml @@ -1,4 +1,4 @@ -definition: index=zeek sourcetype="zeek:ssl:json" +definition: sourcetype="zeek:ssl:json" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. name: zeek_ssl From 8d6d3b45bdf6b2acb9c857025eed05283687fca3 Mon Sep 17 00:00:00 2001 From: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> Date: Thu, 2 Jan 2025 06:58:09 +0000 Subject: [PATCH 2/3] Updated TAs --- contentctl.yml | 4 ++-- data_sources/crowdstrike_processrollup2.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/contentctl.yml b/contentctl.yml index 570a20607c..9ba69c6502 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -77,9 +77,9 @@ apps: - uid: 5579 title: Splunk Add-on for CrowdStrike FDR appid: Splunk_TA_CrowdStrike_FDR - version: 2.0.2 + version: 2.0.3 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-crowdstrike-fdr_202.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-crowdstrike-fdr_203.tgz - uid: 3185 title: Splunk Add-on for Microsoft IIS appid: SPLUNK_TA_FOR_IIS diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index 7e7a54deeb..83b05821b9 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -10,7 +10,7 @@ separator: event_simpleName supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 2.0.2 + version: 2.0.3 fields: - AuthenticationId - AuthenticationId_meaning From 83b3111dabac170f56e230f5f58ea4a164bf4829 Mon Sep 17 00:00:00 2001 From: ljstella Date: Fri, 3 Jan 2025 14:39:59 -0600 Subject: [PATCH 3/3] Pin container to 9.3 --- contentctl.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contentctl.yml b/contentctl.yml index 9ba69c6502..5f224e985d 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -21,8 +21,8 @@ test_instance: hec_port: 8088 web_ui_port: 8000 api_port: 8089 - full_image_path: registry.hub.docker.com/splunk/splunk:latest container_settings: + full_image_path: registry.hub.docker.com/splunk/splunk:9.3 leave_running: true num_containers: 1 mode: {}