From a nice bloke on reddit: Example if you are using lookups normally: | lookup my_lookup1.csv field1 OUTPUT outfield1 | lookup my_lookup2.csv field1 OUTPUT outfield2 | eval outfield = coalesce(outfield1,outfield2,"not found") | eval tablesource = case(isnotnull(outfield1),"my_lookup1.csv", isnotnull(outfield2),"my_lookup2.csv", true(),"not found") Example if you are using inputlookup: | inputlookup my_lookup1.csv | eval tablesource="my_lookup1.csv" | inputlookup my_lookup2.csv append=true | eval tablesource=coalesce(tablesource,"my_lookup2.csv") ... View more

I know it's been a while...but does anyone know if that admin_api.set_proxy line still works? Thanks. ... View more

Sure but the options to configure it are missing from my account settings page. I wanted to enable the dark theme and line numbering...and the options simply aren't there. ... View more

I have found that I must remove the '(edit OR editXML)' part of the query and add 'NOT StreamedSearch' to get the actual results. ... View more

Yeah I'd like to take a look at the script too. Does it work with SC or directly with Nessus? Thanks! ... View more

After many restarts of our splunk boxes (all of them) it magically started working and I was able to add my security center box to the app configuration. However, I gave up on this because to make this work it also needs a heavy forwarder. This rings as rather odd to me when you are essentially using REST and login creds for your SC box to be able to login and pull back data. Shouldn't need a heavy forwarder IMO...and I don't have time to build one. Nor have I even seen what benefit there is to hooking them together. Not even a screenshot. So for now I just login to SC to view my vuln data. Thanks. ... View more

Every figure out if a syslog server can sit between the fireeye and splunk? I am getting data form the fireeye to splunk currently with SYSLOG CSV UDP but the app and TA dont seem to be doing anything. Thanks! ... View more

Every figure out if a syslog server can stand between a fireeye and splunk? Trying to set this up and i am getting data to splunk from the fireeye (SYSLOG CSV UDP) but the app and TA don't seem to be doing anything. Thanks! ... View more

Yeah i have Splunk_TA_Nessus 5.1.0 currently and I think that's what shipped with the latest version of ES. ... View more

Thanks! But hmm, my code looks nothing like that haha. I guess i'll keep poking. $SPLUNK_HOME/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/security_center.py 132 response, content = http.request( 133 self._uri(path), method, data, headers) 134 135 if path.find('download') != -1: 136 return content 137 138 result = json.loads(content) 139 140 self._error_check(response, result) 141 142 set_cookie = response.get('set-cookie') 143 144 if set_cookie: 145 self._cookie = set_cookie[set_cookie.find(',') + 1:].strip() 146 stulog.logger.debug('{} set-cookie={}'.format(self._logger_prefix, 147 set_cookie)) 148 stulog.logger.debug('{} self._cookie={}'.format( 149 self._logger_prefix, self._cookie)) 150 151 return result['response'] ... View more

I am running SC 5.4.2...wonder if that's why I am seeing this. Or maybe I applied the line of code wrong. Could you tell me which line comes before/after the line you added from jbailey? I have code on line 138 so i wasn't sure if it should go before or after said line. To be clear i am getting this error message when trying to add a Security Center server to the TA config. Thanks @worshamn ! ... View more

Do we know if this fix works for when using Security Center 5.4+ or is it as @worshamn says below and 5.4+ just isn't supported yet? Thanks! ... View more

Update: I created the same real time alert without using a join (however I do need a join) and I am getting more emails for that alert than the one with the join. Could this be a timing or resource thing? ... View more