-
Filtering in rsyslog
If you use rsyslog as a syslog collector in front of your Splunk indexers, I will show you a way to filter out data in rsyslog, to avoid spending valuable indexer or forwarder resources.
-
Why you have to start loving JSON and stop using XML
I recently had to onboard XML data in to Splunk. To say the least, this is not something that is done straight out of the box. This time around I […]
-
Add trusted root certificate to python running under Splunk context [DRAFT]
Create a .py file with the following content: Run the script in the context of Splunk: Then add your certificate in base64-format to this file to let Splunk trust your […]
-
GIAC Network Forensic Analyst (GNFA)
Had a great time taking SANS FOR572 in Amsterdam back in August 2019. Nailed the exam with 90% in December, making me a GIAC certified network forensic analyst (GNFA). This […]
-
Retrieve the full certificate chain from a server
Retrieve the full certificate chain from a server (any port): openssl s_client -host sipfed.online.lync.com -port 5061 -prexit -showcerts