search

hRun / SA-haveibeenpwned

Splunk add-on providing a custom search command to query Troy Hunt's haveibeenpwned API (https://haveibeenpwned.com/api/v3/) for known breaches of your domains or mail addresses.
https://splunkbase.splunk.com/app/5050/
Apache License 2.0
6 stars 4 forks source link

Pates issues - not displayed #7

Closed robertodandrea closed 1 year ago

robertodandrea commented 1 year ago

Hello, I’m having problems with the haveibeenpwned command. When I run the command on Splunk

| haveibeenpwned mode=mail

This is what I expected from the search:

_time emai breach paste
2022-01-01 00:00:00 test@gmail.com No breach reported for given account and time frame. No paste reported for given account and time frame.

But sometimes the column is not displayed.

Has anyone had this problem before?

--- Thanks --

hRun commented 1 year ago

hi there,

i've never encountered this during testing or in the environment where i use the add-on. haven't heard anyone reporting the phenomenon either. might be splunk having the hiccups or some conditions i didn't properly test. e.g. if the hibp api can't be reached the paste field might not be created as expected. i'll certainly see if i can reproduce this, please just allow me some time.

cheers, hRun

hRun commented 1 year ago

it turned out, that there were some changes to the api's rate limiting since the add-on's last release. the search would now sometimes run into timeouts which were not properly handled by the script. i'll push an updated version of the add-on shortly both here and on splunkbase. it now includes a new parameter on the configuration page to specify your api key's individual rate limitation (make sure to set it to the appropriate value after upgrading the add-on) as well as some other improvements. the results are now consistent on my testing device.

robertodandrea commented 1 year ago

Great! @hRun I’ll wait for the new version