DCSO / TIE-Splunk-TA

DCSO Threat Intelligence Engine (TIE) Add-On for Splunk v8
BSD 3-Clause "New" or "Revised" License
3 stars 2 forks source link

Add support for Splunk v8 and Python v3 #9

Closed geertjanvdk closed 4 years ago

geertjanvdk commented 4 years ago

We adapt the code so that it works exclusively with Python v3 (3.7 or greater). The code has been reorganized and corrected where needed. This way we are able to test the tie2index.py script without the need to have Splunk running. Code has been split int the bin/ and lib/ folders. This will make it easier to extend and reuse.

The setup.xml has been extended with more inline help so that the user installing the add-on has bit more information as to what to fill in. We add also the possibility to configure a sequence number when setting up the add-on. This makes it easier to upgrade or install it new and start from a particular point.

Logging of the add-on is now done to a separate file called dcso_tie.log within the Splunk logging folder. This is a good place to start looking when debugging issues.

The setup.py was added with a custom distutils command called splunkdist. This makes it easy to create a distribution ready to be used in Splunk.

The README has been revamped with new documentation and new structure.