Merge pull request #1194 from splunk/support-thycotic-secret-server

feat(thycotic): support secret server
splunk · Jul 13, 2021 · 7a1b0a6 · 7a1b0a6
2 parents 6c9d46f + f3faba5
commit 7a1b0a6
Show file tree

Hide file tree

Showing 3 changed files with 58 additions and 0 deletions.
diff --git a/docs/sources/Thycotic/index.md b/docs/sources/Thycotic/index.md
@@ -0,0 +1,39 @@
+# Vendor - Tenable
+
+
+## Product - Tenable.nnm
+
+| Ref            | Link                                                                                                    |
+|----------------|---------------------------------------------------------------------------------------------------------|
+| Splunk Add-on  | https://splunkbase.splunk.com/app/4060/                                                                 |
+| Product Manual | https://docs.tenable.com/integrations/Splunk/Content/Splunk2/ProcessWorkflow.htm                        |
+
+
+### Sourcetypes
+
+| sourcetype     | notes                                                                                                   |
+|----------------|---------------------------------------------------------------------------------------------------------|
+| thycotic:syslog       | None                                                                                                    |
+
+### Sourcetype and Index Configuration
+
+| key            | sourcetype     | index          | notes          |
+|----------------|----------------|----------------|----------------|
+| Thycotic Software_Secret Server      | thycotic:syslog       | netauth          | none          |
+
+### Filter type
+
+CEF
+
+### Options
+
+| Variable       | default        | description    |
+|----------------|----------------|----------------|
+
+### Verification
+
+An active device will generate frequent events. Use the following search to validate events are present per source device
+
+```
+index=<asconfigured> sourcetype=thycotic:syslog  | stats count by host
+```
diff --git a/mkdocs.yml b/mkdocs.yml
@@ -59,6 +59,7 @@ nav:
       - Broadcom: sources/Broadcom/index.md
       - Tanium: sources/Tanium/index.md
       - Tenable: sources/Tenable/index.md
+      - Thycotic: sources/Thycotic/index.md
       - Tintri: sources/Tintri/index.md
       - Trend: sources/Trend/index.md
       - Ubiquiti: sources/Ubiquiti/index.md

diff --git a/package/etc/conf.d/conflib/cef/app-cef-thycotic_secret_server.conf b/package/etc/conf.d/conflib/cef/app-cef-thycotic_secret_server.conf
@@ -0,0 +1,18 @@
+block parser cef-thycotic_secret_server-parser() {    
+    channel {
+        rewrite {
+            r_set_splunk_dest_default(
+                index('netauth'),
+                sourcetype('thycotic:syslog')
+            );
+        };          
+
+    };   
+};
+application cef-thycotic_secret_server[cef] {
+	filter{
+        match("Thycotic Software" value("fields.cef_device_vendor"))
+        and match("Secret Server" value("fields.cef_device_product"));
+    };
+    parser { cef-thycotic_secret_server-parser(); };   
+};