search

murchisd / splunk_pstree_app

Custom Splunk search command to reconstruct a pstree from Sysmon process creation events (EventCode 1)
22 stars 4 forks source link

Nice job! #1

Closed j-stoner closed 2 years ago

j-stoner commented 3 years ago

I just installed this today on a system based on some recent exercises we conducted and I really like what you did here, great job!

Do you have any plans on submitting to Splunkbase and making it cloud certified? If not no worries, but wanted to check and see what your plans were.

Again, great job, it looks solid! -john

murchisd commented 3 years ago

Hey John,

Thank you! Glad you like it! I had not originally considered submitting to Splunkbase but with the recent attention this app has received I will look in to that.

Any tips for getting an app Cloud Certified? I am currently working with Splunk PS to start the cloud vetting process but that was just for my organization.

Thanks again, Donald

j-stoner commented 3 years ago

There is a who bunch of documents that talk about how this works, here is a link to what this looks like. https://dev.splunk.com/enterprise/docs/releaseapps/splunkbase/

I ran the tgz through appinspect last night. Appinspect can be downloaded from the dev site above and basically checks the app that it complies with general application standards both for on premise and then there are options to check for cloud. When I ran that, the biggest thing was having default stanza in the authorize.conf file. Aside from that, maybe a README.MD file and an icon file or two is all it appeared to be looking for. Anyway, the reason I mention this is that I do know that we often get requests about apps and folks tend to like stuff on Splunkbase and increasingly cloud certified as well.

For full disclosure, I am on the security strategist team at splunk and having published a MISP integration on github, that was the first thing I was asked when someone looked at deploying it.

Let me know what we can do to assist!

murchisd commented 3 years ago

Hey John,

I addressed the issues you mentioned and the app is now on Splunkbase, https://splunkbase.splunk.com/app/5721/. However, I am not sure what the process is to initiate Cloud vetting. I don't see any options when managing the app in Splunkbase.

Do you have any knowledge on how to start the process?

j-stoner commented 3 years ago

For whatever reason your 1.0.2 did not make its way to app vetting. I was able to get that rolling yesterday so hopefully a positive outcome will be forthcoming soon.

On Sep 25, 2021, at 11:35 AM, Donald Murchison @.***> wrote:

Hey John,

I addressed the issues you mentioned and the app is now on Splunkbase, https://splunkbase.splunk.com/app/5721/ https://splunkbase.splunk.com/app/5721/. However, I am not sure what the process is to initiate Cloud vetting. I don't see any options when managing the app in Splunkbase.

Do you have any knowledge on how to start the process?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/murchisd/splunk_pstree_app/issues/1#issuecomment-927137911, or unsubscribe https://github.com/notifications/unsubscribe-auth/AF3P4KUE4Y7KB4KD5YIDRTDUDXT4RANCNFSM5CVS2X6Q. Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

murchisd commented 2 years ago

App has been vetted and approved for Cloud. Thanks for your help!