New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added ability to use app as TA on forwarder #4

Open

himynamesdave wants to merge 1 commit into master from simplify-setup

himynamesdave commented Dec 7, 2016

added default index “mhn” to avoid issues around setting default indexes, dumping data in default Splunk ended etc.
added default source type to potentially catch any log format changes in future
also added new index and source type to search in UI xml view. IMPORTANT: this will break the app for existing users
above allows app to be used as TA on forwarder to simplify setup for user.
readme updated to reflect this


          Added ability to use app as TA on forwarder

49c8f06

Contributor

jatrost commented Dec 8, 2016

@himynamesdave Currently we recommend users to run the following on their MHN server: https://github.com/threatstream/mhn/blob/master/scripts/install_splunk_universalforwarder.sh (assuming most of our MHN users don't have splunk on their MHN server) AND https://github.com/threatstream/mhn/blob/master/scripts/install_hpfeeds-logger-splunk.sh.

If we make the changes outlined in this PR, what changes would need to be made to these install scripts from the MHN project?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet