splunk/sa-awsassets

This supporting add-on comes with prebuilt content for AWS data to be easily used with Splunk Enterprise Security's asset database.

AWS Assets for Splunk Enterprise Security

Documentation · Splunkbase . Report a Bug

This supporting add-on comes with prebuilt content for AWS asset data to be easily used with Splunk Enterprise Security's asset database.

Important

This supporting add-on is only intended to work with Splunk Enterprise Security deployments

About

Info	Description
SA-AwsAssets	1.0.4 - Splunkbase
Splunk Enterprise Security Version (Required)	7.x | 6.x
Splunk Add-on for AWS (Required)	6.x

Disclaimer

This Splunk Supporting Add-on is not affiliated with AWS, Inc. and is not sponsored or sanctioned by the AWS team. Please visit https://aws.amazon.com/ for more information about AWS.

sa-awsassets's Issues

nt_host field contains duplicate values

Describe the bug
The nt_host field contains duplicate values.

To Reproduce
n/a

Expected behavior
unique values for nt_host field

Screenshots
n/a

Versions (please complete the following information):

• Splunk Version: 9.0.1
• Splunk Add-on for AWS Version: 6.2.0
• Splunk Enterprise Security Version: 7.0.2
• SA-AwsAssets Version (This add-on): 1.0.0

Additional context
fix my adding mvdedup command to the nt_host field.

Lookup file error, unknown path or update time

Describe the bug
Full output of issue:

file=identity_manager.py:lookup_last_update:387 | status="Lookup file error, unknown path or update time" name=crowdstrike_devices

To Reproduce
Run the following search:

index=_internal sourcetype="identity_correlation:modular_input" ERROR

Expected behavior
No errors from the identity manager.

Screenshots
n/a

Versions (please complete the following information):

• Splunk Version: 9.0
• SA-SentinelOneDevices Version: 1.0.0
• SentinelOne App For Splunk Version: 5.1.7
• Enterprise Security Version: 7.0.1

Additional context
n/a

EC2 instances with multiple network interfaces do not get their ip and mac address fields rendered correctly

Describe the bug
EC2 instances with multiple network interfaces do not get their ip and mac address fields rendered correctly in that they are treated as mv fields rather than a pipe-concatenated string.

Expected behavior
According to https://docs.splunk.com/Documentation/ES/latest/Admin/Formatassetoridentitylist, if an asset has multiple IP addresses, these should be separated by a pipe character. Ditto for multiple MAC addresses.

Versions (please complete the following information):

• SA-AwsAssets Version (This add-on): 1.0.2

Additional context
I believe that the fix is to simply add the following after the call to iplocate:

| eval ip = mvjoin(ip,"|")
| eval mac = mvjoin(mac,"|")

It should be noted that the call to iplocation will also fail if there are multiple interfaces. I'm not sure how to handle it, other than simply using the first interface perhaps.