Re: Documentation about Corelight's Splunk Apps for Zeek

--===============1447350968==
Content-Type: multipart/alternative; boundary="000000000000d247f2059a24e1a8"

--000000000000d247f2059a24e1a8
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Also in the Apps that Amber pointed to in the "Details" tab, there are
instructions for install/config.
Though depending on the environment specific instructions around
sourcetypes and index names will differ due to local configuration.

-s

On Fri, Dec 20, 2019 at 7:45 AM Amber Graner <[email protected]> wrote=
:

> Hi Carlos,
>
> I reached out to Corelight and below is the response:
>
> Docs and downloads can be found here:
> App - https://splunkbase.splunk.com/app/3884/
> TA - https://splunkbase.splunk.com/app/3885/
>
> At a very basic level the install guidance is this:
>
>    - For stand alone Splunk instances - install the Corelight App for
>    Splunk ONLY using the Splunk Web UI
>    - For distributed instances - installed the Corelight App for Splunk
>    on search head(s) using the Splunk Web UI, install the TA on indexers
>    and/or heavy forwarders using install method of choice (cli, web ui, o=
r
>    deployment server)
>
> Thanks,
> ~Amber
>
> On Fri, Dec 20, 2019 at 7:03 AM Amber Graner <[email protected]>
> wrote:
>
>> Hi Carlos,
>>
>> As that is a Corelight offering and not something maintained by the Zeek
>> Project or the community, we=E2=80=99d have to refer you to Corelight.
>>
>> Let me find out who you need to talk to and I=E2=80=99ll make introducti=
ons.
>>
>> Thanks,
>> ~Amber
>>
>> On Fri, Dec 20, 2019 at 3:56 AM Carlos Lopez <[email protected]> wrote:
>>
>>> Hi all,
>>>
>>>
>>>
>>> I would like to install Corelight App For Splunk and TA for Corelight,
>>> but there is no documentation about how to accomplish it =E2=80=A6 All =
info points
>>> to https://www.corelight.com/support/, but there is no docs in there =
=E2=80=A6
>>>
>>>
>>>
>>> Any idea?
>>>
>>>
>>>
>>>
>>>
>>> --
>>>
>>> Regards,
>>>
>>> C. L. Martinez
>>> _______________________________________________
>>> Zeek mailing list
>>> [email protected]
>>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>>
>> --
>>
>> *Amber Graner*
>> Director of Community
>> Corelight, Inc
>>
>> 828.582.9469
>>
>> Schedule time on my calendar here. <https://calendly.com/amber_graner>
>>
>>
>>
>>  * Ask me about how you can participate in the Zeek (formerly Bro)
>> community.
>>  * Remember - ZEEK AND YOU SHALL FIND!!
>>
>>
>>
>
> --
>
> *Amber Graner*
> Director of Community
> Corelight, Inc
>
> 828.582.9469
>
> Schedule time on my calendar here. <https://calendly.com/amber_graner>
>
>
>
>  * Ask me about how you can participate in the Zeek (formerly Bro)
> community.
>  * Remember - ZEEK AND YOU SHALL FIND!!
>
>
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek



--=20
*Stephen R. Smoot, PhD*
VP, Customer Success
Corelight

--000000000000d247f2059a24e1a8
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Also in the Apps that Amber pointed to in the &quot;Detail=
s&quot; tab, there are instructions for install/config.<div>Though dependin=
g on the environment specific instructions around sourcetypes and index nam=
es will differ due to local configuration.</div><div><br><div>-s</div></div=
></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr"=
>On Fri, Dec 20, 2019 at 7:45 AM Amber Graner &lt;<a href=3D"mailto:akgrane=
[email protected]">[email protected]</a>&gt; wrote:<br></div><blockquote=
 class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px so=
lid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">Hi Carlos,<div><br>=
</div><div>I reached out to Corelight and below is the response:</div><div>=
<br></div><div>Docs and downloads=C2=A0can be found here:<div>App -=C2=A0<a=
 href=3D"https://splunkbase.splunk.com/app/3884/" target=3D"_blank">https:/=
/splunkbase.splunk.com/app/3884/</a></div><div>TA -=C2=A0<a href=3D"https:/=
/splunkbase.splunk.com/app/3885/" target=3D"_blank">https://splunkbase.splu=
nk.com/app/3885/</a></div><div><br></div><div>At a very basic level the ins=
tall guidance is this:</div><div><ul><li style=3D"margin-left:15px">For sta=
nd alone Splunk instances - install the Corelight App for Splunk ONLY using=
 the Splunk Web UI</li><li style=3D"margin-left:15px">For distributed insta=
nces - installed the=C2=A0Corelight App for Splunk on search head(s) using =
the Splunk Web UI, install the TA on indexers and/or heavy forwarders using=
 install method of choice (cli, web ui, or deployment server)</li></ul><div=
>Thanks,</div></div></div><div>~Amber</div></div><br><div class=3D"gmail_qu=
ote"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, Dec 20, 2019 at 7:03 AM =
Amber Graner &lt;<a href=3D"mailto:[email protected]" target=3D"_blank=
">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmail=
_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204=
,204);padding-left:1ex"><div><div dir=3D"auto">Hi Carlos,=C2=A0</div></div>=
<div dir=3D"auto"><br></div><div dir=3D"auto">As that is a Corelight offeri=
ng and not something maintained by the Zeek Project or the community, we=E2=
=80=99d have to refer you to Corelight.</div><div dir=3D"auto"><br></div><d=
iv dir=3D"auto">Let me find out who you need to talk to and I=E2=80=99ll ma=
ke introductions.=C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"auto">=
Thanks,</div><div dir=3D"auto">~Amber=C2=A0</div><div><br><div class=3D"gma=
il_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, Dec 20, 2019 at 3:5=
6 AM Carlos Lopez &lt;<a href=3D"mailto:[email protected]" target=3D"_blan=
k">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmail_qu=
ote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,20=
4);padding-left:1ex">





<div lang=3D"ES">
<div>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt">Hi all=
,<u></u><u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt"><u></u=
>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt">I woul=
d like to install Corelight App For Splunk and TA for Corelight, but there =
is no documentation about how to accomplish it =E2=80=A6 All info points to
</span><a href=3D"https://www.corelight.com/support/" target=3D"_blank"><sp=
an lang=3D"EN-US">https://www.corelight.com/support/</span></a><span lang=
=3D"EN-US">, but there is no docs in there =E2=80=A6<u></u><u></u></span></=
p>
<p class=3D"MsoNormal"><span lang=3D"EN-US"><u></u>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US">Any idea?</span></p></div></div=
><div lang=3D"ES"><div><p class=3D"MsoNormal"><span lang=3D"EN-US"><u></u><=
u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt"><u></u=
>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt"><u></u=
>=C2=A0<u></u></span></p>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt">--=C2=
=A0<u></u><u></u></span></p>
<div>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt">Regard=
s,<u></u><u></u></span></p>
</div>
<p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11pt">C. L. =
Martinez</span><span lang=3D"EN-US"><u></u><u></u></span></p>
</div>
</div>

_______________________________________________<br>
Zeek mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br>
<a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n=
oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi=
nfo/zeek</a></blockquote></div></div>-- <br><div dir=3D"ltr"><div dir=3D"lt=
r"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D=
"ltr"><div><br></div><div><b>Amber Graner</b><br></div><div dir=3D"ltr"><di=
v>Director of Community</div><div>Corelight, Inc</div><div><br></div><div>8=
28.582.9469</div><div><br></div><div>Schedule time on my calendar <a href=
=3D"https://calendly.com/amber_graner" target=3D"_blank">here.</a></div><di=
v><br></div><div>=C2=A0=C2=A0<img src=3D"https://docs.google.com/uc?export=
=3Ddownload&amp;id=3D1Pst1UL56ibuX2pFmisz34iKLVlU8LSjd&amp;revid=3D0B0wAXWx=
dbUhfQmZtTHhhTlJtS3ZuZnN1QkRDRW80UjZnTno4PQ" width=3D"96" height=3D"30">=C2=
=A0<img src=3D"https://docs.google.com/uc?export=3Ddownload&amp;id=3D1eqoMc=
NL7TDN2I-N9dIlYt0Yidwg04aeu&amp;revid=3D0B0wAXWxdbUhfSTdRUThMWitxYUE5MTczVH=
pIUUFIVE5jdmFvPQ" width=3D"96" height=3D"39"><br></div><div><br></div><div>=
=C2=A0* Ask me about how you can participate in the Zeek (formerly Bro) com=
munity.</div><div>=C2=A0* Remember - ZEEK AND YOU SHALL FIND!!</div><div><b=
r></div><div><br></div></div></div></div></div></div></div></div></div></di=
v>
</blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"ltr"=
><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div dir=3D"l=
tr"><div dir=3D"ltr"><div><br></div><div><b>Amber Graner</b><br></div><div =
dir=3D"ltr"><div>Director of Community</div><div>Corelight, Inc</div><div><=
br></div><div>828.582.9469</div><div><br></div><div>Schedule time on my cal=
endar <a href=3D"https://calendly.com/amber_graner" target=3D"_blank">here.=
</a></div><div><br></div><div>=C2=A0=C2=A0<img src=3D"https://docs.google.c=
om/uc?export=3Ddownload&amp;id=3D1Pst1UL56ibuX2pFmisz34iKLVlU8LSjd&amp;revi=
d=3D0B0wAXWxdbUhfQmZtTHhhTlJtS3ZuZnN1QkRDRW80UjZnTno4PQ" width=3D"96" heigh=
t=3D"30">=C2=A0<img src=3D"https://docs.google.com/uc?export=3Ddownload&amp=
;id=3D1eqoMcNL7TDN2I-N9dIlYt0Yidwg04aeu&amp;revid=3D0B0wAXWxdbUhfSTdRUThMWi=
txYUE5MTczVHpIUUFIVE5jdmFvPQ" width=3D"96" height=3D"39"><br></div><div><br=
></div><div>=C2=A0* Ask me about how you can participate in the Zeek (forme=
rly Bro) community.</div><div>=C2=A0* Remember - ZEEK AND YOU SHALL FIND!!<=
/div><div><br></div><div><br></div></div></div></div></div></div></div></di=
v></div></div>
_______________________________________________<br>
Zeek mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br>
<a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n=
oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi=
nfo/zeek</a></blockquote></div><br clear=3D"all"><div><br></div>-- <br><div=
 dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"lt=
r"><div style=3D"color:rgb(136,136,136);font-size:12.8px"><font face=3D"ari=
al, helvetica, sans-serif" size=3D"2" color=3D"#000000"><b>Stephen R. Smoot=
, PhD</b></font></div><div><font color=3D"#000000" face=3D"arial, helvetica=
, sans-serif" size=3D"2">VP, Customer Success</font></div><div style=3D"col=
or:rgb(136,136,136);font-size:12.8px"><font face=3D"arial, helvetica, sans-=
serif" size=3D"2" color=3D"#000000">Corelight</font></div><div style=3D"col=
or:rgb(136,136,136);font-size:12.8px"></div></div></div></div></div>

--000000000000d247f2059a24e1a8--

--===============1447350968==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============1447350968==--