Re: Documentation about Corelight's Splunk Apps for Zeek

--===============0101612362==
Content-Type: multipart/alternative; boundary="00000000000048fb90059a247b33"

--00000000000048fb90059a247b33
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Carlos,

I reached out to Corelight and below is the response:

Docs and downloads can be found here:
App - https://splunkbase.splunk.com/app/3884/
TA - https://splunkbase.splunk.com/app/3885/

At a very basic level the install guidance is this:

   - For stand alone Splunk instances - install the Corelight App for
   Splunk ONLY using the Splunk Web UI
   - For distributed instances - installed the Corelight App for Splunk on
   search head(s) using the Splunk Web UI, install the TA on indexers and/o=
r
   heavy forwarders using install method of choice (cli, web ui, or deploym=
ent
   server)

Thanks,
~Amber

On Fri, Dec 20, 2019 at 7:03 AM Amber Graner <[email protected]> wrote=
:

> Hi Carlos,
>
> As that is a Corelight offering and not something maintained by the Zeek
> Project or the community, we=E2=80=99d have to refer you to Corelight.
>
> Let me find out who you need to talk to and I=E2=80=99ll make introductio=
ns.
>
> Thanks,
> ~Amber
>
> On Fri, Dec 20, 2019 at 3:56 AM Carlos Lopez <[email protected]> wrote:
>
>> Hi all,
>>
>>
>>
>> I would like to install Corelight App For Splunk and TA for Corelight,
>> but there is no documentation about how to accomplish it =E2=80=A6 All i=
nfo points
>> to https://www.corelight.com/support/, but there is no docs in there =E2=
=80=A6
>>
>>
>>
>> Any idea?
>>
>>
>>
>>
>>
>> --
>>
>> Regards,
>>
>> C. L. Martinez
>> _______________________________________________
>> Zeek mailing list
>> [email protected]
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>
> --
>
> *Amber Graner*
> Director of Community
> Corelight, Inc
>
> 828.582.9469
>
> Schedule time on my calendar here. <https://calendly.com/amber_graner>
>
>
>
>  * Ask me about how you can participate in the Zeek (formerly Bro)
> community.
>  * Remember - ZEEK AND YOU SHALL FIND!!
>
>
>

--=20

*Amber Graner*
Director of Community
Corelight, Inc

828.582.9469

Schedule time on my calendar here. <https://calendly.com/amber_graner>



 * Ask me about how you can participate in the Zeek (formerly Bro)
community.
 * Remember - ZEEK AND YOU SHALL FIND!!

--00000000000048fb90059a247b33
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Carlos,<div><br></div><div>I reached out to Corelight a=
nd below is the response:</div><div><br></div><div>Docs and downloads=C2=A0=
can be found here:<div>App -=C2=A0<a href=3D"https://splunkbase.splunk.com/=
app/3884/" target=3D"_blank">https://splunkbase.splunk.com/app/3884/</a></d=
iv><div>TA -=C2=A0<a href=3D"https://splunkbase.splunk.com/app/3885/" targe=
t=3D"_blank">https://splunkbase.splunk.com/app/3885/</a></div><div><br></di=
v><div>At a very basic level the install guidance is this:</div><div><ul><l=
i style=3D"margin-left:15px">For stand alone Splunk instances - install the=
 Corelight App for Splunk ONLY using the Splunk Web UI</li><li style=3D"mar=
gin-left:15px">For distributed instances - installed the=C2=A0Corelight App=
 for Splunk on search head(s) using the Splunk Web UI, install the TA on in=
dexers and/or heavy forwarders using install method of choice (cli, web ui,=
 or deployment server)</li></ul><div>Thanks,</div></div></div><div>~Amber</=
div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_at=
tr">On Fri, Dec 20, 2019 at 7:03 AM Amber Graner &lt;<a href=3D"mailto:akgr=
[email protected]">[email protected]</a>&gt; wrote:<br></div><blockqu=
ote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px=
 solid rgb(204,204,204);padding-left:1ex"><div><div dir=3D"auto">Hi Carlos,=
=C2=A0</div></div><div dir=3D"auto"><br></div><div dir=3D"auto">As that is =
a Corelight offering and not something maintained by the Zeek Project or th=
e community, we=E2=80=99d have to refer you to Corelight.</div><div dir=3D"=
auto"><br></div><div dir=3D"auto">Let me find out who you need to talk to a=
nd I=E2=80=99ll make introductions.=C2=A0</div><div dir=3D"auto"><br></div>=
<div dir=3D"auto">Thanks,</div><div dir=3D"auto">~Amber=C2=A0</div><div><br=
><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, D=
ec 20, 2019 at 3:56 AM Carlos Lopez &lt;<a href=3D"mailto:[email protected]=
m" target=3D"_blank">[email protected]</a>&gt; wrote:<br></div><blockquote=
 class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px so=
lid rgb(204,204,204);padding-left:1ex">





<div lang=3D"ES">
<div>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt">Hi all=
,<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt"><u></u=
>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt">I woul=
d like to install Corelight App For Splunk and TA for Corelight, but there =
is no documentation about how to accomplish it =E2=80=A6 All info points to
</span><a href=3D"https://www.corelight.com/support/" target=3D"_blank"><sp=
an lang=3D"EN-US">https://www.corelight.com/support/</span></a><span lang=
=3D"EN-US">, but there is no docs in there =E2=80=A6<u></u><u></u></span></=
p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><u></u>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Any idea?</span></p></div></div=
><div lang=3D"ES"><div><p class=3D"MsoNormal"><span lang=3D"EN-US"><u></u><=
u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt"><u></u=
>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt"><u></u=
>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt">--=C2=
=A0<u></u><u></u></span></p>
<div>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt">Regard=
s,<u></u><u></u></span></p>
</div>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt">C. L. =
Martinez</span><span lang=3D"EN-US"><u></u><u></u></span></p>
</div>
</div>

_______________________________________________<br>
Zeek mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br>
<a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n=
oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi=
nfo/zeek</a></blockquote></div></div>-- <br><div dir=3D"ltr"><div dir=3D"lt=
r"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D=
"ltr"><div><br></div><div><b>Amber Graner</b><br></div><div dir=3D"ltr"><di=
v>Director of Community</div><div>Corelight, Inc</div><div><br></div><div>8=
28.582.9469</div><div><br></div><div>Schedule time on my calendar <a href=
=3D"https://calendly.com/amber_graner" target=3D"_blank">here.</a></div><di=
v><br></div><div>=C2=A0=C2=A0<img src=3D"https://docs.google.com/uc?export=
=3Ddownload&amp;id=3D1Pst1UL56ibuX2pFmisz34iKLVlU8LSjd&amp;revid=3D0B0wAXWx=
dbUhfQmZtTHhhTlJtS3ZuZnN1QkRDRW80UjZnTno4PQ" width=3D"96" height=3D"30">=C2=
=A0<img src=3D"https://docs.google.com/uc?export=3Ddownload&amp;id=3D1eqoMc=
NL7TDN2I-N9dIlYt0Yidwg04aeu&amp;revid=3D0B0wAXWxdbUhfSTdRUThMWitxYUE5MTczVH=
pIUUFIVE5jdmFvPQ" width=3D"96" height=3D"39"><br></div><div><br></div><div>=
=C2=A0* Ask me about how you can participate in the Zeek (formerly Bro) com=
munity.</div><div>=C2=A0* Remember - ZEEK AND YOU SHALL FIND!!</div><div><b=
r></div><div><br></div></div></div></div></div></div></div></div></div></di=
v>
</blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"ltr"=
 class=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div=
 dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div><br></div><div><b>Amber=
 Graner</b><br></div><div dir=3D"ltr"><div>Director of Community</div><div>=
Corelight, Inc</div><div><br></div><div>828.582.9469</div><div><br></div><d=
iv>Schedule time on my calendar <a href=3D"https://calendly.com/amber_grane=
r" target=3D"_blank">here.</a></div><div><br></div><div>=C2=A0=C2=A0<img sr=
c=3D"https://docs.google.com/uc?export=3Ddownload&amp;id=3D1Pst1UL56ibuX2pF=
misz34iKLVlU8LSjd&amp;revid=3D0B0wAXWxdbUhfQmZtTHhhTlJtS3ZuZnN1QkRDRW80UjZn=
Tno4PQ" width=3D"96" height=3D"30">=C2=A0<img src=3D"https://docs.google.co=
m/uc?export=3Ddownload&amp;id=3D1eqoMcNL7TDN2I-N9dIlYt0Yidwg04aeu&amp;revid=
=3D0B0wAXWxdbUhfSTdRUThMWitxYUE5MTczVHpIUUFIVE5jdmFvPQ" width=3D"96" height=
=3D"39"><br></div><div><br></div><div>=C2=A0* Ask me about how you can part=
icipate in the Zeek (formerly Bro) community.</div><div>=C2=A0* Remember - =
ZEEK AND YOU SHALL FIND!!</div><div><br></div><div><br></div></div></div></=
div></div></div></div></div></div></div>

--00000000000048fb90059a247b33--

--===============0101612362==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============0101612362==--