{"id":22180580,"url":"https://github.com/dcso/tie-splunk-ta","last_synced_at":"2025-08-01T06:12:34.554Z","repository":{"id":47445190,"uuid":"171305110","full_name":"DCSO/TIE-Splunk-TA","owner":"DCSO","description":"DCSO Threat Intelligence Engine (TIE) Add-On for Splunk v8","archived":false,"fork":false,"pushed_at":"2024-01-31T13:06:12.000Z","size":64,"stargazers_count":3,"open_issues_count":7,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-02-01T13:36:35.005Z","etag":null,"topics":["splunk","splunk-addon","splunk-application","technical-addon"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/DCSO.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2019-02-18T15:07:36.000Z","updated_at":"2024-01-31T13:10:31.000Z","dependencies_parsed_at":"2024-01-02T10:54:41.449Z","dependency_job_id":"dbb44d37-4bd0-4903-8906-580f3a01dfc4","html_url":"https://github.com/DCSO/TIE-Splunk-TA","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCSO%2FTIE-Splunk-TA","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCSO%2FTIE-Splunk-TA/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCSO%2FTIE-Splunk-TA/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DCSO%2FTIE-Splunk-TA/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/DCSO","download_url":"https://codeload.github.com/DCSO/TIE-Splunk-TA/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":227700405,"owners_count":17806365,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["splunk","splunk-addon","splunk-application","technical-addon"],"created_at":"2024-12-02T09:18:46.190Z","updated_at":"2024-12-02T09:18:46.731Z","avatar_url":"https://github.com/DCSO.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"DCSO Threat Intelligence Engine (TIE) Add-On for Splunk\n=======================================================\n\nCopyright (c) 2015, 2023, DCSO Deutsche Cyber-Sicherheitsorganisation GmbH\n\nSplunk add-on for the DCSO Threat Intelligence Engine (TIE) which fetches IoCs (Indicator of Compromise)\nand stores them into a Splunk index.\n\n# Prerequisites and Installation\n\nMost of the AddOn's functionality can be used and tested without having Splunk installed.\n\n* Python v3.7 or greater.\n* Splunk Enterprise 8 or greater.\n* DCSO API credentials.\n* Connection from your Splunk instance(s) to https://api.dcso.de (check your firewall setup)\n\n## Installation\n\nYou can install the DCSO TIE AddOn within the Splunk Enterprise Web interface:\n\n1. click on the `splunk\u003eenterprise`-logo\n2. click on the wheel next to 'Apps'\n3. click 'Install app from file'\n4. choose the file, navigating to the folder on your local machine containing a file called like `DCSO_TIE_Splunk_AddOn3-3.0.0.zip`\n5. if you are upgrading, make sure to check 'Upgrade app'\n6. click 'Upload'\n\nYou can also install the add-on through the Splunk CLI (Command Line Interface):\n\n```\n${SPLUNK_HOME}/bin/splunk install app DCSO_TIE_Splunk_AddOn3-3.0.0.zip\n```\n\n# Configuration\n\nAfter installation, the add-on needs to be configured.\n\n## Splunk App Setup Page\n\nImportant: when after saving an error appears in the Splunk Web tool, the configuration is stored, but\nit does not give much information what went wrong.\nTo find out the issue, you will have to look in the log file (see below).\n\nDCSO IDM credentials are required to access the Threat Intelligence Engine or TIE.\nIf you have any questions about the credentials, please contact DCSO (see below).\n\nThere are few more details about the configuration:\n\n* **API Client ID**: DCSO IDM client_id.\n* **API Client Secret**: DCSO IDM client_secret.\n* **Initial IoC Update Time**: Use this to start from a particular time from where IoC were updated. \n  This should be a timestamp in RFC3339 format. This is useful when re-installing or upgrading to \n  incompatible add-on version (data in index would stay compatible). Leave 0 to use whatever data \n  is stored or start from NOW minus 30 days.\n* **tie2index.py** script: make sure to enable this by un-checking the checkbox.\n* **Index for IoCs**: the index used to store IoCs (events). When using a custom index, it\n  must already exist.\n* **Severity \u0026 Confidence**: can be provided as number as well as range (or example `1-` or `30-90`).\n\n## Standard Filter\n\nThe default settings for the filter can be found in the file `default/dcso_tie_setup.conf` and are\nfilled out when setting up the add-on.\n\n#  Usage\n\n## Getting the IoCs\n\n### tie2index.py\n\nThe input script `tie2index.py` will automatically start with the oldest IoC in a 30 day range. From\nthat it will iterate and index all updates made. The interval is by default 10 minutes (600 seconds).\nAll IoCs and their updates will be stored in an index (default: dcso_app_tie-api). We recommend at\nleast 180 days as retention time for this index. From this index all lookups and files can be derived.\n\nTo limit the used licence volume we only index IoCs within specified confidence and severity ranges.\nThe default ranges of the filters are mentioned in the section 'Standard Filter'.\n\n## Logging\n\nThis add-on will log errors, warnings, and other informative messages to a separate log file within\nthe folder `${SPLUNK_HOME}/var/log/splunk`. The file is called `dcso_tie.log` and is rotated 6 times.\n\nThe entries in this log file are stored, when executed by Splunk, as JSON. This makes it ready to be\nmonitored by Splunk itself.\n\n# Contact\n\n* Email: ti-support [a] dcso.de\n* Website: https://dcso.de\n\n# Development \u0026 Deployment\n\n## Development\n\n### Debugging the setup.xml\n\nYou can use `xmllint` to validate or check the `setup.xml` file:\n\n```\n$ xmllint /path/to/setup.xml --noout --relaxng ${SPLUNK_HOME}/share/splunk/search_mrsparkle/exposed/schema/setup.rng\n```\n\n### Running tests\n\nTests can be run using the following command from the root of the repository:\n\n```shell\n$ python tests/tests.py\n```\n\n## Deployment\n\nThe add-on can be packaged using the normal `distutils` command. However, for Splunk we needed\nto adapt a bit so that it is easy to create, deploy and install.\n\n## For Splunk\n\nThis add-on has it's own `distutils` command called `splunkdist`:\n\n```shell\n$ python setup.py splunkdist --format=zip\n```\n\nThe above command will create a ZIP archive in the folder `dist/`. The name of the file is so that\nit contains the major and full version of this add-on. The folder it unpacks too has simply the\nmajor version, for example:\n\n```\n$ python setup.py splunkdist --format=zip\n\n# creates:\ndist/DCSO_TIE_Splunk_AddOn3-3.0.0.zip\n\n$ unzip -l dist/DCSO_TIE_Splunk_AddOn3-3.0.0.zip\nArchive:  dist/DCSO_TIE_Splunk_AddOn3-3.0.0.zip\n  Length      Date    Time    Name\n---------  ---------- -----   ----\n        0  05-26-2020 13:36   DCSO_TIE_AddOn3/\n        0  05-26-2020 13:36   DCSO_TIE_AddOn3/bin/\n        0  05-26-2020 13:36   DCSO_TIE_AddOn3/default/\n        0  05-26-2020 13:36   DCSO_TIE_AddOn3/static/\n...\n```\n\n# License\n\nSee LICENSE file included in the repository.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdcso%2Ftie-splunk-ta","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdcso%2Ftie-splunk-ta","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdcso%2Ftie-splunk-ta/lists"}