Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/vulnerscom/splunk-vulners
Splunk Vulnerability Assessment Plugin
https://github.com/vulnerscom/splunk-vulners
scaner splunk splunk-dashboard vulnerability vulnerability-assessment vulners
Last synced: 3 days ago
JSON representation
Splunk Vulnerability Assessment Plugin
- Host: GitHub
- URL: https://github.com/vulnerscom/splunk-vulners
- Owner: vulnersCom
- License: gpl-3.0
- Created: 2020-05-22T09:19:56.000Z (over 4 years ago)
- Default Branch: master
- Last Pushed: 2022-12-29T13:27:46.000Z (almost 2 years ago)
- Last Synced: 2023-06-26T02:52:48.037Z (over 1 year ago)
- Topics: scaner, splunk, splunk-dashboard, vulnerability, vulnerability-assessment, vulners
- Language: Python
- Homepage: https://vulners.com
- Size: 2.43 MB
- Stars: 7
- Watchers: 3
- Forks: 3
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Vulners App for Splunk
Vulners Application for Splunk allows one to use Splunk as a Vulnerability assessment platform and security scanner.
### Notes
- The app was tested in a simple installation as well as in a clustered (search head cluster) installation
- As a result it is a whole package that includes parts for three Splunk components: forwarders, indexers (indexer cluster) and search heads (search head clusters).
## Installation
Installation process is described in details within the [app directory](./vulners-lookup/README.md)
___
## Usage
#### 1. Search for packages collected using python scripted input from the app
By default scripted input is sending information about packages hourly. You must enable it before it starts to collect the data.
To see collected packages run search
```
index=vulners
```
#### 2. Ad-hoc Vulners audit request
Vulners application is running audit script automatically at 9 o'clock in the morning. You must enable it before it starts to work.
Alternatively you can hit saved search
```
| savedsearch vulners_report
```
## Using [slim](https://dev.splunk.com/enterprise/docs/releaseapps/packagingtoolkit/installpkgtoolkit)
- Install slim as in the instruction (take note of [this bug](https://answers.splunk.com/answers/773820/error-while-running-slim-partition-command.html) though)
- Create a package
```
slim package -o result/ ./vulners-lookup/
```