New version of the Splunk analyzer for Cortex

[LetMeR00t]

Hello everyone,

This is a new analyzer for Cortex which is able to search data into Splunk.
This version is different (even if inspired) from this PR : #142

For those who known how Splunk work, I though that this PR was not a good version of how a Splunk analyzer must be. In this new version, we are using savedsearches. No request is hardcoded in the JSON files. Moreover, templates are now available for TheHive.

Please, let me know if I have to change something but this analyzer seems to be a must have for me.

I will update the CortexDocs soon to have all the details about this analyzer of course.

Thank you

[LetMeR00t]

Documentation is done and a PR is waiting.

Here some screenshots of the result :



Note: Here saved searches are called "Temporary"

Thank you

[LetMeR00t]

Hi,
upstream/master (your master) was merged into this feature
Thank you

[DaveCLowe]

What needs to happen to merge this PR? It would be very helpful.
Thanks

[LetMeR00t]

Hi,
upstream/master (your master) was merged into this feature
Thank you

[LetMeR00t]

Thank you.
If you need any help according to this analyzer, please mention me.

[jeromeleonard]

Thank you. Yes we might indeed need some help. We used to use CortexDocs for documentation. In the meantime, we migrated our documentation to https://thehive-project.github.io/Cortex-Analyzers. Do you think it is possible to update this analyzer to contain all interesting info for the documentation ? All instructions there: https://thehive-project.github.io/Cortex-Analyzers/analyzers_definition/

[LetMeR00t]

@jeromeleonard ,
No problem at all, I will handle it.
Just one question, do you have a specific branch for this new documentation ? I can't find any example of the Markdown file used in your documentation on your repository ... of course to use the same structure.
Thank you :)

[jeromeleonard]

Everything is automatically generated based on JSON content and README.md file. An example can be found for The Domaintools_Iris analyzer.

[LetMeR00t]

Hi @jeromeleonard,
As requested, you will find the documentation in this new PR : #837
I wasn't able to test it so if you have any trouble, please let me know.
Thank you

[jeromeleonard]

thank you very much. merged.