diff --git a/analyzers/Splunk/splunk.py b/analyzers/Splunk/splunk.py index 252468414..2aebb6dab 100755 --- a/analyzers/Splunk/splunk.py +++ b/analyzers/Splunk/splunk.py @@ -5,6 +5,7 @@ from time import sleep from cortexutils.analyzer import Analyzer import splunklib.results as results +import splunklib import urllib import re from datetime import datetime @@ -70,14 +71,23 @@ def SplunkSearch(self, **kwargs_savedsearch): for saved_search in jobs: job = jobs[saved_search]["job"] if job.is_done(): - jobs[saved_search]["results"] = results.ResultsReader(job.results(count=self.MAX_COUNT)) - jobs[saved_search]["link"] = "http://"+self.HOST+":"+self.PORT_GUI+"/fr-FR/app/"+self.APP+"/search?sid="+job["sid"] - jobs[saved_search]["eventCount"] = int(job["eventCount"]) - jobs[saved_search]["resultCount"] = int(job["resultCount"]) - jobs[saved_search]["searchEarliestTime"] = datetime.utcfromtimestamp(round(float(job["searchEarliestTime"]))).strftime("%c") - jobs[saved_search]["searchLatestTime"] = datetime.utcfromtimestamp(round(float(job["searchLatestTime"]))).strftime("%c") - jobs[saved_search]["search"] = job["search"] - jobs_running -= 1 + try: + jobs[saved_search]["results"] = results.ResultsReader(job.results(count=self.MAX_COUNT)) + jobs[saved_search]["is_failed"] = False + + except splunklib.binding.HTTPError as e: + jobs[saved_search]["results"] = [str(e)] + jobs[saved_search]["is_failed"] = True + + + finally: + jobs[saved_search]["link"] = "http://"+self.HOST+":"+self.PORT_GUI+"/fr-FR/app/"+self.APP+"/search?sid="+job["sid"] + jobs[saved_search]["eventCount"] = int(job["eventCount"]) + jobs[saved_search]["resultCount"] = int(job["resultCount"]) + jobs[saved_search]["searchEarliestTime"] = datetime.utcfromtimestamp(round(float(job["searchEarliestTime"]))).strftime("%c") + jobs[saved_search]["searchLatestTime"] = datetime.utcfromtimestamp(round(float(job["searchLatestTime"]))).strftime("%c") + jobs[saved_search]["search"] = job["search"] + jobs_running -= 1 # Get the results and display them savedSearchResults = [] @@ -119,6 +129,7 @@ def SplunkSearch(self, **kwargs_savedsearch): finally: jobResult["length"] = index + jobResult["failed"] = job_infos["is_failed"] jobResult["link"] = job_infos["link"] jobResult["eventCount"] = job_infos["eventCount"] jobResult["resultCount"] = job_infos["resultCount"] diff --git a/thehive-templates/Splunk_Search_Domain_FQDN_3_0/long.html b/thehive-templates/Splunk_Search_Domain_FQDN_3_0/long.html index 277b462cc..c5b581709 100644 --- a/thehive-templates/Splunk_Search_Domain_FQDN_3_0/long.html +++ b/thehive-templates/Splunk_Search_Domain_FQDN_3_0/long.html @@ -23,33 +23,38 @@ Results for "{{res.savedsearch}}"
-
-
Results:
-
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
-
Error: {{res.error}}
-
Events:
-
{{res.eventCount}}
-
Job:
-
Go to Splunk
-
Earliest time:
-
{{res.searchEarliestTime}} UTC
-
Latest time:
-
{{res.searchLatestTime}} UTC
-
Levels :
-
Info: {{res.levels.info}}
-
Safe: {{res.levels.safe}}
-
Suspicious: {{res.levels.suspicious}}
-
Malicious: {{res.levels.malicious}}
-
- - - - - - - -
{{field}}
{{value}}
{{value}}
-
+
+
+
Results :
+
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
+
Error: {{res.error}}
+
Events :
+
{{res.eventCount}}
+
Job:
+
Go to Splunk
+
Earliest time:
+
{{res.searchEarliestTime}} UTC
+
Latest time:
+
{{res.searchLatestTime}} UTC
+
Levels :
+
Info: {{res.levels.info}}
+
Safe: {{res.levels.safe}}
+
Suspicious: {{res.levels.suspicious}}
+
Malicious: {{res.levels.malicious}}
+
+ + + + + + + +
{{field}}
{{value}}
{{value}}
+
+
+
Error: {{res.results[0]}}
+
+
No result for this search
diff --git a/thehive-templates/Splunk_Search_File_Filename_3_0/long.html b/thehive-templates/Splunk_Search_File_Filename_3_0/long.html index 277b462cc..c5b581709 100644 --- a/thehive-templates/Splunk_Search_File_Filename_3_0/long.html +++ b/thehive-templates/Splunk_Search_File_Filename_3_0/long.html @@ -23,33 +23,38 @@ Results for "{{res.savedsearch}}"
-
-
Results:
-
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
-
Error: {{res.error}}
-
Events:
-
{{res.eventCount}}
-
Job:
-
Go to Splunk
-
Earliest time:
-
{{res.searchEarliestTime}} UTC
-
Latest time:
-
{{res.searchLatestTime}} UTC
-
Levels :
-
Info: {{res.levels.info}}
-
Safe: {{res.levels.safe}}
-
Suspicious: {{res.levels.suspicious}}
-
Malicious: {{res.levels.malicious}}
-
- - - - - - - -
{{field}}
{{value}}
{{value}}
-
+
+
+
Results :
+
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
+
Error: {{res.error}}
+
Events :
+
{{res.eventCount}}
+
Job:
+
Go to Splunk
+
Earliest time:
+
{{res.searchEarliestTime}} UTC
+
Latest time:
+
{{res.searchLatestTime}} UTC
+
Levels :
+
Info: {{res.levels.info}}
+
Safe: {{res.levels.safe}}
+
Suspicious: {{res.levels.suspicious}}
+
Malicious: {{res.levels.malicious}}
+
+ + + + + + + +
{{field}}
{{value}}
{{value}}
+
+
+
Error: {{res.results[0]}}
+
+
No result for this search
diff --git a/thehive-templates/Splunk_Search_Hash_3_0/long.html b/thehive-templates/Splunk_Search_Hash_3_0/long.html index 277b462cc..c5b581709 100644 --- a/thehive-templates/Splunk_Search_Hash_3_0/long.html +++ b/thehive-templates/Splunk_Search_Hash_3_0/long.html @@ -23,33 +23,38 @@ Results for "{{res.savedsearch}}"
-
-
Results:
-
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
-
Error: {{res.error}}
-
Events:
-
{{res.eventCount}}
-
Job:
-
Go to Splunk
-
Earliest time:
-
{{res.searchEarliestTime}} UTC
-
Latest time:
-
{{res.searchLatestTime}} UTC
-
Levels :
-
Info: {{res.levels.info}}
-
Safe: {{res.levels.safe}}
-
Suspicious: {{res.levels.suspicious}}
-
Malicious: {{res.levels.malicious}}
-
- - - - - - - -
{{field}}
{{value}}
{{value}}
-
+
+
+
Results :
+
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
+
Error: {{res.error}}
+
Events :
+
{{res.eventCount}}
+
Job:
+
Go to Splunk
+
Earliest time:
+
{{res.searchEarliestTime}} UTC
+
Latest time:
+
{{res.searchLatestTime}} UTC
+
Levels :
+
Info: {{res.levels.info}}
+
Safe: {{res.levels.safe}}
+
Suspicious: {{res.levels.suspicious}}
+
Malicious: {{res.levels.malicious}}
+
+ + + + + + + +
{{field}}
{{value}}
{{value}}
+
+
+
Error: {{res.results[0]}}
+
+
No result for this search
diff --git a/thehive-templates/Splunk_Search_IP_3_0/long.html b/thehive-templates/Splunk_Search_IP_3_0/long.html index 277b462cc..c5b581709 100644 --- a/thehive-templates/Splunk_Search_IP_3_0/long.html +++ b/thehive-templates/Splunk_Search_IP_3_0/long.html @@ -23,33 +23,38 @@ Results for "{{res.savedsearch}}"
-
-
Results:
-
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
-
Error: {{res.error}}
-
Events:
-
{{res.eventCount}}
-
Job:
-
Go to Splunk
-
Earliest time:
-
{{res.searchEarliestTime}} UTC
-
Latest time:
-
{{res.searchLatestTime}} UTC
-
Levels :
-
Info: {{res.levels.info}}
-
Safe: {{res.levels.safe}}
-
Suspicious: {{res.levels.suspicious}}
-
Malicious: {{res.levels.malicious}}
-
- - - - - - - -
{{field}}
{{value}}
{{value}}
-
+
+
+
Results :
+
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
+
Error: {{res.error}}
+
Events :
+
{{res.eventCount}}
+
Job:
+
Go to Splunk
+
Earliest time:
+
{{res.searchEarliestTime}} UTC
+
Latest time:
+
{{res.searchLatestTime}} UTC
+
Levels :
+
Info: {{res.levels.info}}
+
Safe: {{res.levels.safe}}
+
Suspicious: {{res.levels.suspicious}}
+
Malicious: {{res.levels.malicious}}
+
+ + + + + + + +
{{field}}
{{value}}
{{value}}
+
+
+
Error: {{res.results[0]}}
+
+
No result for this search
diff --git a/thehive-templates/Splunk_Search_Mail_Email_3_0/long.html b/thehive-templates/Splunk_Search_Mail_Email_3_0/long.html index 277b462cc..c5b581709 100644 --- a/thehive-templates/Splunk_Search_Mail_Email_3_0/long.html +++ b/thehive-templates/Splunk_Search_Mail_Email_3_0/long.html @@ -23,33 +23,38 @@ Results for "{{res.savedsearch}}"
-
-
Results:
-
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
-
Error: {{res.error}}
-
Events:
-
{{res.eventCount}}
-
Job:
-
Go to Splunk
-
Earliest time:
-
{{res.searchEarliestTime}} UTC
-
Latest time:
-
{{res.searchLatestTime}} UTC
-
Levels :
-
Info: {{res.levels.info}}
-
Safe: {{res.levels.safe}}
-
Suspicious: {{res.levels.suspicious}}
-
Malicious: {{res.levels.malicious}}
-
- - - - - - - -
{{field}}
{{value}}
{{value}}
-
+
+
+
Results :
+
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
+
Error: {{res.error}}
+
Events :
+
{{res.eventCount}}
+
Job:
+
Go to Splunk
+
Earliest time:
+
{{res.searchEarliestTime}} UTC
+
Latest time:
+
{{res.searchLatestTime}} UTC
+
Levels :
+
Info: {{res.levels.info}}
+
Safe: {{res.levels.safe}}
+
Suspicious: {{res.levels.suspicious}}
+
Malicious: {{res.levels.malicious}}
+
+ + + + + + + +
{{field}}
{{value}}
{{value}}
+
+
+
Error: {{res.results[0]}}
+
+
No result for this search
diff --git a/thehive-templates/Splunk_Search_Mail_Subject_3_0/long.html b/thehive-templates/Splunk_Search_Mail_Subject_3_0/long.html index 277b462cc..c5b581709 100644 --- a/thehive-templates/Splunk_Search_Mail_Subject_3_0/long.html +++ b/thehive-templates/Splunk_Search_Mail_Subject_3_0/long.html @@ -23,33 +23,38 @@ Results for "{{res.savedsearch}}"
-
-
Results:
-
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
-
Error: {{res.error}}
-
Events:
-
{{res.eventCount}}
-
Job:
-
Go to Splunk
-
Earliest time:
-
{{res.searchEarliestTime}} UTC
-
Latest time:
-
{{res.searchLatestTime}} UTC
-
Levels :
-
Info: {{res.levels.info}}
-
Safe: {{res.levels.safe}}
-
Suspicious: {{res.levels.suspicious}}
-
Malicious: {{res.levels.malicious}}
-
- - - - - - - -
{{field}}
{{value}}
{{value}}
-
+
+
+
Results :
+
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
+
Error: {{res.error}}
+
Events :
+
{{res.eventCount}}
+
Job:
+
Go to Splunk
+
Earliest time:
+
{{res.searchEarliestTime}} UTC
+
Latest time:
+
{{res.searchLatestTime}} UTC
+
Levels :
+
Info: {{res.levels.info}}
+
Safe: {{res.levels.safe}}
+
Suspicious: {{res.levels.suspicious}}
+
Malicious: {{res.levels.malicious}}
+
+ + + + + + + +
{{field}}
{{value}}
{{value}}
+
+
+
Error: {{res.results[0]}}
+
+
No result for this search
diff --git a/thehive-templates/Splunk_Search_Other_3_0/long.html b/thehive-templates/Splunk_Search_Other_3_0/long.html index 277b462cc..c5b581709 100644 --- a/thehive-templates/Splunk_Search_Other_3_0/long.html +++ b/thehive-templates/Splunk_Search_Other_3_0/long.html @@ -23,33 +23,38 @@ Results for "{{res.savedsearch}}"
-
-
Results:
-
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
-
Error: {{res.error}}
-
Events:
-
{{res.eventCount}}
-
Job:
-
Go to Splunk
-
Earliest time:
-
{{res.searchEarliestTime}} UTC
-
Latest time:
-
{{res.searchLatestTime}} UTC
-
Levels :
-
Info: {{res.levels.info}}
-
Safe: {{res.levels.safe}}
-
Suspicious: {{res.levels.suspicious}}
-
Malicious: {{res.levels.malicious}}
-
- - - - - - - -
{{field}}
{{value}}
{{value}}
-
+
+
+
Results :
+
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
+
Error: {{res.error}}
+
Events :
+
{{res.eventCount}}
+
Job:
+
Go to Splunk
+
Earliest time:
+
{{res.searchEarliestTime}} UTC
+
Latest time:
+
{{res.searchLatestTime}} UTC
+
Levels :
+
Info: {{res.levels.info}}
+
Safe: {{res.levels.safe}}
+
Suspicious: {{res.levels.suspicious}}
+
Malicious: {{res.levels.malicious}}
+
+ + + + + + + +
{{field}}
{{value}}
{{value}}
+
+
+
Error: {{res.results[0]}}
+
+
No result for this search
diff --git a/thehive-templates/Splunk_Search_Registry_3_0/long.html b/thehive-templates/Splunk_Search_Registry_3_0/long.html index 277b462cc..c5b581709 100644 --- a/thehive-templates/Splunk_Search_Registry_3_0/long.html +++ b/thehive-templates/Splunk_Search_Registry_3_0/long.html @@ -23,33 +23,38 @@ Results for "{{res.savedsearch}}"
-
-
Results:
-
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
-
Error: {{res.error}}
-
Events:
-
{{res.eventCount}}
-
Job:
-
Go to Splunk
-
Earliest time:
-
{{res.searchEarliestTime}} UTC
-
Latest time:
-
{{res.searchLatestTime}} UTC
-
Levels :
-
Info: {{res.levels.info}}
-
Safe: {{res.levels.safe}}
-
Suspicious: {{res.levels.suspicious}}
-
Malicious: {{res.levels.malicious}}
-
- - - - - - - -
{{field}}
{{value}}
{{value}}
-
+
+
+
Results :
+
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
+
Error: {{res.error}}
+
Events :
+
{{res.eventCount}}
+
Job:
+
Go to Splunk
+
Earliest time:
+
{{res.searchEarliestTime}} UTC
+
Latest time:
+
{{res.searchLatestTime}} UTC
+
Levels :
+
Info: {{res.levels.info}}
+
Safe: {{res.levels.safe}}
+
Suspicious: {{res.levels.suspicious}}
+
Malicious: {{res.levels.malicious}}
+
+ + + + + + + +
{{field}}
{{value}}
{{value}}
+
+
+
Error: {{res.results[0]}}
+
+
No result for this search
diff --git a/thehive-templates/Splunk_Search_URL_URI_Path_3_0/long.html b/thehive-templates/Splunk_Search_URL_URI_Path_3_0/long.html index 277b462cc..c5b581709 100644 --- a/thehive-templates/Splunk_Search_URL_URI_Path_3_0/long.html +++ b/thehive-templates/Splunk_Search_URL_URI_Path_3_0/long.html @@ -23,33 +23,38 @@ Results for "{{res.savedsearch}}"
-
-
Results:
-
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
-
Error: {{res.error}}
-
Events:
-
{{res.eventCount}}
-
Job:
-
Go to Splunk
-
Earliest time:
-
{{res.searchEarliestTime}} UTC
-
Latest time:
-
{{res.searchLatestTime}} UTC
-
Levels :
-
Info: {{res.levels.info}}
-
Safe: {{res.levels.safe}}
-
Suspicious: {{res.levels.suspicious}}
-
Malicious: {{res.levels.malicious}}
-
- - - - - - - -
{{field}}
{{value}}
{{value}}
-
+
+
+
Results :
+
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
+
Error: {{res.error}}
+
Events :
+
{{res.eventCount}}
+
Job:
+
Go to Splunk
+
Earliest time:
+
{{res.searchEarliestTime}} UTC
+
Latest time:
+
{{res.searchLatestTime}} UTC
+
Levels :
+
Info: {{res.levels.info}}
+
Safe: {{res.levels.safe}}
+
Suspicious: {{res.levels.suspicious}}
+
Malicious: {{res.levels.malicious}}
+
+ + + + + + + +
{{field}}
{{value}}
{{value}}
+
+
+
Error: {{res.results[0]}}
+
+
No result for this search
diff --git a/thehive-templates/Splunk_Search_User_3_0/long.html b/thehive-templates/Splunk_Search_User_3_0/long.html index 277b462cc..c5b581709 100644 --- a/thehive-templates/Splunk_Search_User_3_0/long.html +++ b/thehive-templates/Splunk_Search_User_3_0/long.html @@ -23,33 +23,38 @@ Results for "{{res.savedsearch}}"
-
-
Results:
-
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
-
Error: {{res.error}}
-
Events:
-
{{res.eventCount}}
-
Job:
-
Go to Splunk
-
Earliest time:
-
{{res.searchEarliestTime}} UTC
-
Latest time:
-
{{res.searchLatestTime}} UTC
-
Levels :
-
Info: {{res.levels.info}}
-
Safe: {{res.levels.safe}}
-
Suspicious: {{res.levels.suspicious}}
-
Malicious: {{res.levels.malicious}}
-
- - - - - - - -
{{field}}
{{value}}
{{value}}
-
+
+
+
Results :
+
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
+
Error: {{res.error}}
+
Events :
+
{{res.eventCount}}
+
Job:
+
Go to Splunk
+
Earliest time:
+
{{res.searchEarliestTime}} UTC
+
Latest time:
+
{{res.searchLatestTime}} UTC
+
Levels :
+
Info: {{res.levels.info}}
+
Safe: {{res.levels.safe}}
+
Suspicious: {{res.levels.suspicious}}
+
Malicious: {{res.levels.malicious}}
+
+ + + + + + + +
{{field}}
{{value}}
{{value}}
+
+
+
Error: {{res.results[0]}}
+
+
No result for this search
diff --git a/thehive-templates/Splunk_Search_User_Agent_3_0/long.html b/thehive-templates/Splunk_Search_User_Agent_3_0/long.html index 277b462cc..c5b581709 100644 --- a/thehive-templates/Splunk_Search_User_Agent_3_0/long.html +++ b/thehive-templates/Splunk_Search_User_Agent_3_0/long.html @@ -23,33 +23,38 @@ Results for "{{res.savedsearch}}"
-
-
Results:
-
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
-
Error: {{res.error}}
-
Events:
-
{{res.eventCount}}
-
Job:
-
Go to Splunk
-
Earliest time:
-
{{res.searchEarliestTime}} UTC
-
Latest time:
-
{{res.searchLatestTime}} UTC
-
Levels :
-
Info: {{res.levels.info}}
-
Safe: {{res.levels.safe}}
-
Suspicious: {{res.levels.suspicious}}
-
Malicious: {{res.levels.malicious}}
-
- - - - - - - -
{{field}}
{{value}}
{{value}}
-
+
+
+
Results :
+
{{res.length}}/{{res.resultCount}}
Note: {{res.note}}
+
Error: {{res.error}}
+
Events :
+
{{res.eventCount}}
+
Job:
+
Go to Splunk
+
Earliest time:
+
{{res.searchEarliestTime}} UTC
+
Latest time:
+
{{res.searchLatestTime}} UTC
+
Levels :
+
Info: {{res.levels.info}}
+
Safe: {{res.levels.safe}}
+
Suspicious: {{res.levels.suspicious}}
+
Malicious: {{res.levels.malicious}}
+
+ + + + + + + +
{{field}}
{{value}}
{{value}}
+
+
+
Error: {{res.results[0]}}
+
+
No result for this search