Channel Futures is a leading source of analysis, commentary, research, market insight, information and news in the technology and telecommunications industries for managed service providers, channel partners, agents and consultants.

Ruling In Splunk Lawsuit Against Cribl Pleases Both Companies

The jury in the Splunk-Cribl lawsuit found that Cribl did infringe Splunk&#x27;s copyright and breach its contract but awarded damages of just $1.

Splunk-Cribl lawsuit yields mixed result for both companies | TechTarget

SAN FRANCISCO, April 24, 2024 -- In a victory for innovation, the United States District Court for the Northern District of California has ruled that

Cribl Wins Fair Use Case in Splunk Lawsuit, Ensuring Continued Interoperability

Ruling affirms fair use for interoperability in the tech industry; Splunk awarded $1 for copyright and contract violationsSAN FRANCISCO, April 23, 2024 (GLOBE NEWSWIRE) -- In a victory for innovation, the United States District Court for the Northern District of California has ruled that Cribl’s ...

Fair Use Wins: Court Sides with Cribl in Splunk’s Lawsuit

Starbucks Corp. is asking a federal appeals court to toss a labor board ruling that the company illegally hampered a Seattle worker’s ability to testify at an administrative hearing · Workers in Texas need to connect obesity to an underlying physiological disorder or cause to sue for disability ...

Splunk Jury Awards $1 for Software Copyright Win Over Cribl (1)

A California federal jury on Monday awarded software company Splunk a single dollar in damages in a suit accusing rival Cribl of copyright infringement.

$1 Awarded To Software Co. Splunk In Copyright Fight - Law360

The Cisco executive leadership team is being reorganized on the heels of the company’s EVP and COO Maria Martinez, leaving the company last month and as Cisco prepares to close its Splunk deal and shifts its focus to high growth areas, such as AI and security.

Cisco ELT Reshuffle Comes As Company Prepares For Splunk, ‘Key Priority’ Tech Focus

Splunk Inc.‘s agreement to pay $30 million to resolve class allegations it misled investors before its stock’s worst selloff ever got final approval from a federal judge.

Splunk Gets Final Nod on $30 Million Stock Selloff Settlement

BRUSSELS (Reuters) - Cisco Systems (NASDAQ:CSCO) is set to secure unconditional EU antitrust approval for its $28 billion bid for cybersecurity firm Splunk (NASDAQ:SPLK), two people with direct knowledge of the matter said on Tuesday.

Cisco's Splunk deal set to win unconditional EU antitrust OK, sources say By Reuters

Splunk

splunk

Splunk can be a complex beast, with its various components, requirements, and best practices on top of the OS selection and infrastructure design…deploying it can feel like an impossible task. Lucky for us, Splunk has created Validated Architectures that are proven to be effective and….just work. To truly appreciate what the Splunk Validated are, you need to first take a few steps back and look at how Splunk was deployed before 2017 when the Validated Architecture white paper was released. As a customer, you were left with two choices. Architectures Either you hired a consultancy to come in and train you while designing your Splunk infrastructure OR you spent days and weeks building up the required level of knowledge to understand Splunk well enough to deploy it. The stakes were high! On one hand, you might spend tens or hundreds of thousands of dollars with a consultancy and end up with an architecture you barely understand. On the other, you might attempt to build it yourself and wind up rebuilding it (at a much greater expense) down the road when it fails to scale or you run into performance issues. Fast forward to 2017, when the Splunk Validated Architectures (SVAs) were made public at Splunk’s .conf2017 conference in Washington DC. The validated architectures gave everyone the hard-earned knowledge and wisdom to build a world-class Splunk architecture that suited their needs. The SVAs provided a few notable benefits. , they allowed customers to standardize their architecture to one that is known and understood by Splunk support. This in turn streamlined troubleshooting sessions and future architecture decisions. , this reduced the total cost of ownership (TCO) for Splunk deployments. Because the architectures were tuned for just enough power, but not too much, you no longer had to worry that you had over-provisioned your hardware stack. , and maybe most importantly, it allowed you (the Splunk customer) to begin your Splunk journey heading down the right path. You could focus on data onboarding, user training, and content creation in Splunk instead of constantly worrying about your design decisions. First Second Third The Splunk SVAs lay out seven architectures, although there are really three that are the most popular. Those three will be what we focus on here, the other four are great…but most people reading this won’t need help figuring those other four out…they will be paying a consultant. The “Single Server Deployment” All Splunk components, from indexing, and licensing to searching, are installed on a single server. This is a great way to get started in Splunk if the reasons why you use Splunk are not mission-critical. Because this is a single-server architecture, you will have no redundancy. This means when it comes time to patch Splunk or the OS, Splunk will be offline during that period and no logs will be collected. No one will be able to access Splunk for content and no alerts will be generated during this down period. This single-server SVA is also limited in its capacity to ingest data. Splunk says it will handle ~300GB a day, but that sounds like a made-up number. I would put the number closer to 150GB a day. It is however a really simple deployment with very low overhead. The “Distributed Clustered Deployment - single site” In this model, the major Splunk components are separated from each other. This establishes the three-tier approach with a separate management plane. The first tier is the collection tier, which includes universal forwarders, heavy forwarders, and all other data sources. The next tier is dedicated to data ingesting and parsing, and it’s called the indexing tier. In this tier, there are two or more “indexer” servers that are centrally managed by an indexer cluster master. The indexer cluster master maintains unified configurations across all of the indexers in the cluster, allowing administrators a simple path toward scaling the index as the need arises. It’s important to remember, the indexer cluster master is a separate Splunk component that is installed on a separate dedicated server (possibly along with other management components like the license master, management console, and deployment server). This SVA has a single search head, which means that while there is data ingest redundancy provided by the indexer cluster there isn’t any redundancy for search head activities like content creation, report & alert generation, or running queries. This is a very popular architecture that many organizations choose to use because of the redundant data ingest capabilities. Although there isn’t redundancy in the search head, search head failures are very rare and can be easily resolved with a reboot. The Multi-Site Distributed Clustered Deployment with a Search Head (SHC) This architecture takes redundancy to the next level by effectively cloning the single-site distributed deployment we just talked about. Not only is each site redundant and able to process data independent of the other sites’ clusters, but there is also a complete set of data replicated between sites. That, coupled with a search head cluster per site provides a measure of redundancy not found in any other SVA. This does however increase the complexity of the deployment, increase the TCO through infrastructure costs, and can make troubleshooting more difficult because of the issues that are common when connecting two remote sites together. If your organization operates in multiple clouds or on-premises data centers and you have the requirement to deliver Splunk as though it’s a mission-critical app, this SVA is hard to pass on. I focused this post on reviewing the 3 best SVAs made available through the Splunk white paper, but I would be remiss if I didn’t mention that nearly half of the white paper is dedicated to showcasing the nuances of clustered search head and indexer configurations. If those are topics that you are curious about, be sure to check out the rest of the white paper. Also Published Here

Rock Solid Splunk or How I Learned to Love Splunk Validated Architectures

is a data aggregation and open source intelligence tool, which allows users to index blockchain data and run their own investigations using the power of Splunk (check out our ). NTerminal intro blog post Now partnering with CipherTrace, you can use CipherTrace data through NTerminal for KYC and KYT investigations on blockchain activity. NTerminal is now enriched with a larger attribution database, allowing for tagging of blockchain addresses with geolocations, risk scores, known entities and much more. In addition to this, leveraging the Splunk developer community, investigations can integrate a number of  graphical visualizations empowering users to develop flexible and complex risk assessment tools. Alongside NTerminal’s natural language and financial data, users can conduct ecosystem wide investigations on the blockchain through a number of different methods. NTerminal’s Natural Language Processing module monitors a number of law enforcement and regulatory feeds to scan for newly posted sanctions on blockchain addresses. When a new address is sanctioned by the US government, NTerminal will register this address within our attribution database, logging the date of attribution. NTerminal Sources identifying US Sanctioned addresses Timeline of newly sanctioned addresses by US Government. Newly sanctioned addresses are added to NTerminal, then enriched with a number of other sources such as CipherTrace to identify the country of origin, any known abuse reports, and risk scores. Addresses transacting with sanctioned entities following the date of sanctioning can be identified and visualized using a number of Splunk based graphical tools. The visualization tool in Splunk allows users to graph directional relationships between blockchain addresses. Using time series data within NTerminal, transactions following the sanction date for a particular entity can be mapped using the Link Analysis tool. Link Analysis Attribution data for US sanctioned addresses, with identified inflow and outflow addresses. Directional relationships between addresses can identify addresses associated with a sanctioned entity, which might be used following a sanction event to relocate funds. Using the Sankey diagram the weight of these connections can be visualized for in-depth CTF and AML investigations. Transaction flow in NTerminal using Sankey diagram and CipherTrace attribution. can be used to identify points of exchange, convergence between distributed funds and new storage addresses for sanctioned entities. Sankey diagrams Link analysis can be effective for not only relating new addresses to sanctioned entities but also characterizing relationships between CipherTrace risk tagged addresses. Using flagged transactions and addresses, link analysis functionality can correlate dark market participants with gambling services, risk tagged exchanges, and regulated USD markets. Link analysis within NTerminal using CipherTrace attribution to identify bitcoin pipelines moving funds through dark markets, gambling services, high risks exchanges and regulated USD markets. Highlighting dark market associated addresses through link analysis and CipherTrace attribution. Connected addresses can then be flagged as dark market participants and related to other tagged services. In addition to the link analysis tool, the can be used to graphically represent relationships between addresses and tagged entities by the value and quantity of transactions, CipherTrace risk scores, and associations to illicit activity. Using the same data represented above, relationships between unknown addresses with risky entities and services can be visualized and aggregated in 3 dimensional space. 3D Graph Network Topology Visualization Network topology of addresses with associations to dark markets and high risk exchanges. Additional addresses with associations to smart contracts and gambling services. These graphs can be used to determine the associated risk and behavior of blockchain addresses based on proximity and connection strength to tagged entities. Graph network topology visualizations allows users and NTerminal analysts to construct risk and compliance scoring calculations based on the number and strength of connections to highlighted entities through CipherTrace. CipherTrace cryptocurrency intelligence can also be used to display the types of entities an address transacts with, in addition to the quantity of transactions. In the following , relationships depicted in the Graph network topology visualization were displayed in relation to entity tags. The center ring refers to the set of addresses under investigation. The outer ring reflects the types of entities they transact with. This is another method within NTerminal for graphically representing the activity of a given address and for users to develop a profile around a given address. Sunburst visualization The Sunburst visualization can also be used to follow funds, map risk based on proximity to original addresses and trace dilution/mixing of funds with other addresses and services. Using CipherTrace attribution of hack-associated blockchain entities, addresses associated with known hack events can be identified, highlighted and then traced to uncover affiliated addresses and locate stolen funds. Sunburst diagram reflecting fund tracking and risk coloring of Hack associated addresses. Similarly, Sankey diagrams within NTerminal can be used in tandem with CipherTrace attribution to trace transactions sequentially in order to follow the movement of funds between entities, countries, and services on the blockchain. Use Sankey diagrams to trace the flow of transactions between addresses as they related to CipherTrace tagged hack addresses. These investigative visualization tools enriched with CipherTrace data are brought together into one comprehensive analysis framework within NTerminal. Explore a number of KYC and KYT use cases for criminal investigations, compliance, network research and more through NTerminal's blockchain forensics suite.

Blockchain Investigations in NTerminal - Powered by Splunk & CipherTrace

Diy IoT is incredibly fun, and the barrier to entry is pretty low. There are wifi connected arduino boards out there to be had for $10–$20. Much of the time these boards will become packed with sensors and able to monitor their surroundings easily. Examples include temperature, humidity, barmoetric pressure, light and motion. Building further sensor gateways and gathering that data from the ‘dunios quickly shoots up the learning curve and gets developers quickly frustrated trying to gather from boards and process the data. Using a couple libraries one can quickly and simply get this data pushed into a personal splunk instance. This is done through a simple web post to the Splunk Http Event Collector or “hec.” From there the sky is the limit. https://www.adafruit.com/category/35 First things first what is an arduino? Arduinos are an entire clarification of microcontoller boards. Some are configured bare bones and others are esp8266 chips with extra memory space and breakouts. The boards used in this explanation are Adafruit “Huzzah” 8266 breakouts. These are used because of cost of materials, an arduino Uno board is the entry level board for $20. It is a bare microcontroller which would then require a second “shield” in order to bundle a wifi controller onto it. It is much easier to get a simple cheap huzzah. Adafruit has a great community of tutorials and getting started guides to get the Arduino IDE downloaded and configured, and then installing the proper libraries to support the huzzah board. Those libraries are then leveraged for the http and wifi clients. Take a look, get the IDE configured and the boards added here. https://www.arduino.cc/ https://www.adafruit.com/product/2471 https://learn.adafruit.com/add-boards-arduino-v164?view=all Before diving into the Arduino “sketch code”, it should be understood the kind of code we are going to see. Arduinos are pretty much a friendlier “C.” Much of the strongly typed language is there, however String is available and the entire compiling and upload process is done through a nice gui. It can also be done through makefiles and the like but the debugger is at least a little bit better in the Arduino IDE. It’s recommended to start there. A result of the C roots is that working with http requests is going to be a little less than user friendly, but not terrible. The http headers will need to be added and then the content length summed up and finally the entire message bundled up before submitting the http post request. While this isn't the end of the world if someone is not familiar with how http works it could be confusing. Don’t worry, take some time read the code, it will all make sense. Just over 100 lines of code, hopefully that was’t too bad. The majority of the work is broken out into a couple functions. The Loop() function is constantly running because that is how arduino works. Setup() is run once on boot. Then everything else is only run when called. The Loop() gathers up some dummy data and passes it the splunkpost() . If there was a more elaborate data gather needed it could be easily called from the loop and then returned to be sent on to splunkpost(). Splunk post receives all the parameters that were configured at the beginning for the Splunk server, HEC, and some metadata. There is a gotcha in that the http collector is hard coded in the firmware, there are more elegant and configurable ways to do this, however for this purpose it is fine. it should be noted that a rebuild and reflash would be needed if the HEC were to change. Thats all folks! An arduino connected to wifi network and then sending that data directly into Splunk via HEC. All without the need for anything else, no data gateways no serial bit banging between shields to push the sensors to the wifi board. Just sensor data from a DiY arduino going into the robust awesomeness that is Splunk. From Splunk all the analytics number crunching and alerting can be done. Hopefully this was descriptive enough to the wheels turning and the data flowing. Links: _Open-source electronic prototyping platform enabling users to create interactive electronic objects._www.arduino.cc Arduino - Home _Adafruit Industries, Unique & fun DIY electronics and kits Adafruit HUZZAH ESP8266 Breakout ID: 2471 - Add Internet…_www.adafruit.com Adafruit HUZZAH ESP8266 Breakout _Version 1.6.4 of the Arduino IDE introduced official support for adding third party boards (like the Adafruit Flora and…_learn.adafruit.com Overview | Adding Third Party Boards to the Arduino v1.6.4+ IDE | Adafruit Learning System _The HUZZAH ESP8266 breakout is what we designed to make working with this chip super easy and a lot of fun. We took a…_learn.adafruit.com Overview | Adafruit HUZZAH ESP8266 breakout | Adafruit Learning System _Adafruit Industries, Unique & fun DIY electronics and kits : Sensors - Tools Gift Certificates Arduino Cables…_www.adafruit.com Sensors : Adafruit Industries, Unique & fun DIY electronics and kits _The token admin can be the Splunk Enterprise or self-service Splunk Cloud admin, or a different person who does not…_docs.splunk.com About the Splunk HTTP Event Collector - Splunk Documentation

Arduino, Meet Splunk

What happens when you take Splunk, a wireless smart meter and an api interface? Splunking your entire home’s power main, without touching a single power wire! This allows a whole house view of all the power being drawn in real time. The only requirements are raspberry pi on a network, a splunk instance somewhere and a usb adapter plugged into the PI. Hold on, hold on, whats a smart meter? Recently the major power companies have been going around and replacing the old power meters on everybody’s house with a new fancy smart meter. This is essentially just a zigbee enabled power meter than allows power vans to roll down the street and collect all the readings quickly, without having a meter reader go house to house on foot. This page or the page for the a similar provider can be useful when identifying what kind of meter is installed. Then identify the usb dongle that is compatible to the smart meter, most sites have a list of those devices. Then order it up and get it registered via power company. A simple process however it requires paperwork and some lead time. The device that will be used here is the Rainforest EMU-2 Energy Monitoring Unit. / https://www.comed.com/SmartEnergy/SmartMeterSmartGrid/Pages/ForYourHome.aspx https://www.amazon.com/gp/product/B00BGDPRAI Enough of the prework time to dive in. The bulk of the work will be done with a python script that reads from the usb adapter, which is recognized as a serial port on the pi. Then we will install the python script as a service on the pi, which will allow it to run on boot and be easily restarted, and monitored. The python script: There are two requirements here pyRaven and Splunk_hec_handler, those can be found here: The splunk hec handler can also be found in pypi, however at the time of writing the version on pypi was broken and would not pip install, go after the source instead, then do the https://github.com/vavarachen/splunk_hec_handler https://github.com/nonspecialist/pyraven python setup.py install Great we have the requirements and the script. The script is pretty straight forward it connects to the serial port, it will listen to the serial firehose and parse when the data flows across. This is where the usb device is just terrible it has options to query the api but then there is a 4 second lag, during which time the same data will spit out automatically and then again from the query. It is really easier to sit there and listen to the firehose. Regardless the pyraven library does all the work and we are plugging in to it to grab the json object and pass it to a splunkhec function. The splunkhec function receives the data and appends the needed wrapper and posts the event. The posting of the event is then handled by the splunkhec library because why reinvent the wheel and deal with rest posts when we can use a library to do it. What this gives us is a nice json object being loaded into splunk. After we examine the data we can see that a simple splunk search, will give us the graph below. host=gate | timechart avg(event.raw_demand) as Load span=1m The service: In order for the pi to run this script automagically a service template is used and then installed. The service is assuming the the emu.py from above is going to be store in folder. /home/pi/ Alright the next step is to make sure the python script is executable and then install the service template and get it running. That can all be done with the snippet below. Thats all there is to it, the service is running the python script and outputting a whole bunch of nice data to play with. Once the data is acquired then the possibilities are endless for monitoring and reporting out of splunk for high usage or anomalous usage. ***BONUS: (JQ is required for parsing) In order to get the data in to splunk a HTTP collector token is needed. Use curl to generate a token: LINKS: _Splunk indexes and makes searchable data from any app, server or network device in real time including logs, config…_dev.splunk.com Use the CLI to administer HTTP Event Collector | Splunk _This repository allows you to access your Rainforest Automation Emu2 through it's serial interface …_github.com rainforestautomation/Emu-Serial-API _A Python Logging Handler for Splunk HTTP Event Collector (HEC). - vavarachen/splunk_hec_handler_github.com vavarachen/splunk_hec_handler _Interface with a Rainforest Automation RAVEn USB device - nonspecialist/pyraven_github.com nonspecialist/pyraven

Splunking Power Mains

SAS is an s a powerful analytics platform that allows users to perform complex data analysis and modeling tasks. To ensure high levels of performance and scalability, SAS offers a three-tier architecture that separates the different components of the system onto separate servers. This architecture allows for the metadata, data processing, and user interface layers to be installed on different servers for improved performance and scalability. In this article, we will discuss the steps to install a SAS three-tier architecture on an . AWS environment Provisioning EC2 Instances The first step in setting up a SAS three-tier architecture on AWS is to provision three EC2 instances. One instance will be used for the SAS Metadata Server, the second for the SAS Workspace Server, and the third for the SAS Stored Process Server. The size of the instances will depend on the size of your data and the expected load on your system. Here is an example Terraform code to provision three EC2 instances: provider "aws" { region = "us-east-1" } resource "aws_instance" "metadata_server" { ami           = "ami-0c94855ba95c71c99" instance_type = "t2.micro" tags = { Name = "metadata-server" } } resource "aws_instance" "workspace_server" { ami           = "ami-0c94855ba95c71c99" instance_type = "t2.micro" tags = { Name = "workspace-server" } } resource "aws_instance" "stored_process_server" { ami           = "ami-0c94855ba95c71c99" instance_type = "t2.micro" tags = { Name = "stored-process-server" } } Above code, we are using the AWS provider to set the region to us-east-1. We then define three aws_instance resources: metadata_server, workspace_server, and stored_process_server. Each instance has a specified Amazon Machine Image (AMI) and instance type and is tagged with a name for easy identification. Terraform Note that this is a basic example and you may need to modify the code to suit your specific requirements, such as adding additional configuration options, security settings, or networking components. Installing and Configuring the Required Software After provisioning the EC2 instances, the necessary software components need to be installed and configured on each of the instances. This includes installing the operating system, , database software, and SAS software. The specific versions of the software will depend on the version of SAS you are using and the requirements of your organization. Java Runtime Environment (JRE) Here is an example Ansible playbook for installing Java Runtime Environment (JRE), database software, and SAS software (SAS Preferred to installing GUI): name: Install JRE, Database Software, and SAS Software hosts: all become: true vars: java_version: "1.8.0" database_type: "oracle" database_version: "12c" sas_version: "9.4" tasks: name: Install JRE yum: name: "java-{{ java_version }}-openjdk" state: present name: Install {{ database_type }} Database Software yum: name: "{{ database_type }}{{ database_version }}" state: present name: Download SAS Software get_url: url: "https://example.com/sas/{{ sas_version }}/sas_{{ sas_version }}.tar.gz" dest: "/tmp/sas_{{ sas_version }}.tar.gz" name: Extract SAS Software unarchive: src: "/tmp/sas_{{ sas_version }}.tar.gz" dest: "/opt/sas" remote_src: true owner: sas group: sas name: Install SAS Software shell: "/opt/sas/setup.sh -deploy" args: chdir: "/opt/sas/install_data" Setting up the Metadata Server The SAS Metadata Server manages all metadata and user credentials for the SAS environment. Install and configure the SAS Metadata Server on the first EC2 instance. During the installation, you will need to specify the database and the location of the metadata repository. After the installation is complete, configure the metadata server using the SAS Management Console. Setting up the Workspace Server The SAS Workspace Server provides a connection point for SAS clients to execute SAS code and interact with data. Install and configure the SAS Workspace Server on the second EC2 instance. During the installation, you will need to specify the metadata server and the location of the workspace server data. After the installation is complete, configure the workspace server using the SAS Management Console. Setting up the Stored Process Server The SAS Stored Process Server provides a connection point for external applications to execute SAS programs and retrieve results. Install and configure the SAS Stored Process Server on the third EC2 instance. During the installation, you will need to specify the metadata server and the location of the stored process server data. After the installation is complete, configure the stored process server using the SAS Management Console. Configuring Network Settings After installing and configuring all the necessary components, network settings need to be configured to ensure that the three EC2 instances can communicate with each other. Firewall settings, security groups, and network interfaces need to be configured to allow communication between the three servers. It is important to follow best practices for securing your SAS environment on AWS. Testing the Installation Once all the components have been installed and configured, the SAS installation needs to be tested. Connect to the SAS Workspace Server using a SAS client application and run SAS programs on the Stored Process Server to verify that the results are returned correctly. By following the steps outlined in this article, you can install and configure a SAS three-tier architecture on AWS and achieve high levels of performance and scalability for your SAS environment. It is important to follow best practices for securing your SAS environment on AWS and to seek the assistance of a SAS expert if needed. Monitoring  a SAS Three-Tier Architecture using CloudWatch, and Splunk: CloudWatch Monitoring Amazon is a monitoring service for AWS resources and the applications running on them. You can use CloudWatch to collect and track metrics, collect and monitor log files, and set alarms. To monitor a SAS Three-Tier Architecture using , you can use the following steps: CloudWatch CloudWatch Enable CloudWatch logging for each EC2 instance running the SAS Metadata Server, SAS Workspace Server, and SAS Stored Process Server. This will allow CloudWatch to collect log data from each instance. Create CloudWatch alarms to monitor specific metrics for each instance. For example, you can create alarms to monitor CPU usage, memory usage, and disk space usage. Configure CloudWatch dashboards to provide a visual representation of the performance of each instance. This will allow you to easily monitor the performance of the system in real time. Splunk Monitoring is a platform for monitoring, searching, analyzing, and visualizing machine-generated data. You can use Splunk to monitor logs, metrics, and other data generated by the SAS Three-Tier Architecture. To monitor a SAS Three-Tier Architecture using , you can use the following steps: Splunk Splunk Install and configure the Splunk Universal Forwarder on each EC2 instance running the SAS Metadata Server, SAS Workspace Server, and SAS Stored Process Server. This will allow Splunk to collect log data from each instance. Configure Splunk to index the collected log data. Use Splunk to create dashboards and reports that provide insights into the performance of the system. These dashboards and reports can be customized to meet the needs of different stakeholders. Monitoring a SAS Three-Tier Architecture using CloudWatch, and Splunk is essential to ensure that the system is running optimally. By following the steps outlined in this article, you can monitor the performance of the different components of the system and gain insights that can be used to make informed decisions. Lead image . reference References: https://www.sas.com/en_us/home.html https://aws.amazon.com/ https://developer.hashicorp.com/terraform/intro https://www.splunk.com/

Powerful Data Analytics Software:  SAS Three-Tier Architecture Install on AWS Environment 

It is known that the separation between software development teams as well as information technology operations teams that faced many problems in it.  After witnessing this problem, the web-developers came with the idea of developing DevOps which is considered to carry roots in the Agile methodology. The basic function of DevOps is to integrate the set of two teams to improve their collaboration and productivity. Thus there are many different types of definitions citing the concept and practical applications stating how useful the DevOps can be and it also defines that the concept behind its formation is multi-layered. Therefore most of us will surely agree to the fact that continuity and automation are constituted as the big parts of DevOps and probably it is one such tool that helps team members to ensure that these two are the elements that can be implemented possibly as we thought of. Moreover, the organization's specific needs are said to determine that the tools are considered to be the best for them to smooth the functioning of the production process. Given below are the list of best DevOps Tools that will definitely guide in how you could resolve the errors while working on big projects. 1. Docker- A self-reliant tool to solve all queries Docker is considered as the Linux-based open-source platform that focuses on containers and also implies the packaging of the software along with the dependencies and does ship everything together like a unit. It allows one to need not worry about managing dependencies as they can also be managed separately. It is known to be portable and highly securable too and even allows you to use any other language with it too. This tool is also known for integrating seamlessly with the arising number of other tools like Jenkins, Ansible, and Bamboo. It has been revealed by the research firm Forrester has stated that Docker will become the leading company in the field of enterprise . container platform category in the year 2022 2.  Ansible- Sensitising the configuration management through simplification It has been revealed by the that Ansible has become the most favored software automation for the DevOps. CIO It is regarded as the open-source tool for automating software that is efficient for offering provision, configuration management as well as application deployment which can be easily accessed and one doesn’t need to have the set of a dedicated systems administrator. Its functionality uses a simple syntax that uses the YAML language whereas NASA uses Ansible. No special coding skills are required and allow one to model even highly complex IT workflows. 3. GIT - A Retrieving source to view the codings of the past. Git is the highly popular open-source tool that is used by industry giants like Microsoft, Amazon as well as Facebook too. It enables one to track down the progress of their development work and also allow them to coordinate work among their team members. In simpler words, it is the tool that is used to give greater work and also allow one to revert to previously saved versions of the work. It also allows one to create branches separately and even led them to add-in the new set of features especially at the time when they get ready. Thus, a web developer simply needs to host the repository of the work like GitHub. Highly helpful in creating branches that provide an isolated environment for every recurring change in the coding databases. 4. Puppet - Quite helpful in automating and delivering of the software It is a DevOps tool that allows one to manage and automate software inspection and also help in the delivery and management of the business operation. It is considered as the open-source tool that carries a solid track record as well as thousands of modules that could easily integrate with many different platforms. With the help of Puppet, Enterprise one could easily manage the bigger as well as the smaller projects too. Moreover, it also allows one to manage multiple teams as well as thousands of resources. Holds the ability of working on larger infrastructure simply by automating the repetitive tasks. 5. Chef - Capable of configuring cloud-based applications It is considered as the most powerful open-source configuration management tool that allows one to turn their infrastructure into the codes that lets web developers manage data, attributes, roles, and much more. It is the puppet competitor and is known for supporting multiple platforms and can seamlessly integrate with cloud-based platforms. Irrespective of whether the size of the organization is big or small, this tool can automatically configure the infrastructure as well as application deployment and can manage the configurations across the network. It accelerates cloud adoption, improvised the risk management and accelerates software delivery. 6. Jenkins - A Quick tool to resolve coding errors It is the tool that is known for quickly resolving the issues in code and is a free and open-source tool used for automating the delivery pipeline and even allows one to test and report changes in real-time. It is the platform that carries a huge plugin ecosystem and seamlessly integrates with almost every DevOps tool and it also runs efficiently on Windows, Mac OS X, and Linux. To , It requires little maintenance and has built-in GUI tools. start with jenkins 7. Nagios - An Undisputed king to monitor network protocols It is used to find and correct problems that lie in networks and infrastructure, and it is one of the most popular free and open-source monitoring tools. Nagios Core and Nagios XI are the two Nagios editions that are known for offering many features that provide greater functionalities. These tools are used to monitor applications, Services, network protocols, and forum support are also available. It serves as the fast platform to detect outages and protocol failures and works efficiently in boosting the infrastructure of software. 8. Splunk - An advanced Tool that curates machine data It is one such DevOps tool that curates the machine data and even access logs and is said to be usable by almost everyone on the team. Since the machine data comprises a lot of information and is known for improving productivity as well as efficiency, thus it becomes hard for anybody to analyze and visualize that too without using a tool like Splunk. It allows web-developers to build custom-based Splunk applications and integrate it with Splunk data that too in other applications. It doesn’t require any database to store the data and exclusively makes the use of indices to store data. Conclusion In the end, it can be concluded that DevOps tools like , and much more will not only resolve the dispute in the coding but will structure the B2B website in such a manner that it will always remain on the top page of Google. Nagios, Jenkins, Puppet, Chef These tools are quite helpful in removing the technical errors from landing pages and also help in strengthening the founding roots of a website by allowing the digital marketing techniques to blend well with the AWS (Amazon Web Service) and other cloud computing platforms that enable the web-developers to build apps that are multi-functional and help in regaining the clicks of the customers. Moreover, in the coming age of artificial intelligence (AI), it will become very much crucial for web-developers to understand every detail about the significance, importance, and the practical usage of DevOps tools.

DevOps Tools That Will Help in Rectifying Errors in the Databases

Have you ever heard of “ ”? Dark Data It may sound like we are in movie, but it’s really a simple term. The Matrix Let’s say for example, that you work in a company. And one day you realized that there are a lot of data that can’t be used, analyzed, or even found because of certain reasons or circumstances. Well, all of that data is called “ ”. Dark Data Dark data is data that the organization is unaware of or unable to find or even fail to use. Well, I guess that wasn’t hard, right? What’s is that, despite the effort from companies on gathering data, it seems like most of the organizations still aren’t using data properly as soon as they get it. hard According to Splunk’s State of , a lot of organizations have a lot of dark data. The report was a joint effort between Splunk and TRUE Global Intelligence. The companies surveyed over 1,300 business managers and IT leaders. Dark Data Report Can you imagine that over 60% of companies believe that half of their data is dark?! Not only that, but a believe that over 75% of their data is dark. third of them 75%? That’s huge. I am wondering how we get all these are incredible and huge numbers. “Data is hard to work with because it’s growing at an alarming rate and is hard to structure and organize. So, it’s easy for organizations to feel helpless in this chaotic landscape,” (Tim Tully), chief technology officer at Splunk. I did some research and realized that there are high challenges which are faced by these organizations: 1. The huge data volume. 2. The lack of skills and resources. 3. Not having the right motivation from employees to gain more data skills. 4. Bad management & leadership. In the report, they mentioned that 69% of employees said that they want to continue doing what they’re already doing, regardless of the impact on the business or their own career. In simple words, all these employees will have a very hard time in structuring and organizing the data. Unless if they were working in a data-driven role. Personally, I believe that we live in a world with very huge and complicated data. And our world is getting more complex every single day. Different Regions, Different Attitudes About Dark Data There are huge differences between different countries and regions towards dark data. Whether they were opinions, actions, or even education. Let’s take for example. China Nowadays, you can see that people in China are so confident in their abilities about AI, even if their current adoption of AI isn’t that much higher than the global average. But they believe that they can handle their dark data in manageable and efficient ways more than the other countries or regions. Even for countries like , , and , respondents said positive answers about than respondents from other countries did. France Japan Germany 25 percent less Data is so valuable. I hope that companies will start to think about their . Dark data strategy Because by the end of the day, there's a huge power state of dark data and we must bring it into the light. Everyone should be part of the solution.

The Power State of Dark Data.

In my personal experience, the topic of reviewing event logs has received a fair amount grunts, groans, and questions such as “You honestly expect us to review of that data?!” or “We have so many systems! Where would we even begin?” or “We already have enough on our plate to worry about!”. Fortunately, the times have changed, and log aggregation has matured over a relatively short amount of time. Its existence alone however is not the complete answer to log auditing woes. all To start, let’s cover the ‘why’. What is the purpose of undertaking another tedious task and writing out an elaborate SOP? Well, from a practical perspective, incident detection. According to FireEye/Mandiant’s , the global median for detection time of their clients in 2017 was an astounding 101 days. Think about your most important systems and they type of data they process. What kind of information could your organization be bleeding in that timeframe? What if you could have been tipped off to that login from a high risk country, or repeated failed login at your critical servers? M-Trends 2018 report Second, most compliance initiatives request that your organization performs some form of auditing on your event logs. The infamous NIST 800–53, commonly cited across SOX, HIPAA, PCI/DSS, and of course FISMA, request that your organization define a timeframe in which you review your logs. See most controls that are prefaced with an “AU”. Straight forward enough in theory, but let’s examine the practical pieces of the puzzle. Choosing Your Software For starters, the idea of connecting into every system week after week to examine countless event codes across your entire network is not feasible. Having access to a plethora of information is great, but potentially useless without something to parse out the noise. If your organization does not currently have a log aggregation solution, get one set up ASAP. The power and insight into a well-structured log aggregation implementation is invaluable to any organization; if not for security reasons, then for operational troubleshooting. There are quite a few options to choose from, ranging between commercial to open source. is a clear contender for the top spot, and you can get started with a free 500MB license. Splunk was an early product to the game, and has been extensively covered by numerous cybersecurity outlets. If you are looking for a product with support, this is presently the best route to go. If you are even more cost conscious and feeling adventurous, take a look into the open-sourced . This option combines Elasticsearch, Logstash and Kibana into a robust and cost-effective alternative to the commercial products. An alternate option in the free-to-cheap realm is , which comes highly regarded across the community. Splunk ELK Stack Graylog The choice is yours, but at this point in the game there is no reason to not have one. Configuring Your Indexes Now that you have a place to put your logs, which systems will you pull from and how will you structure them? This one is tough, as guidance typically is not clear. Do you pull logs from all of your servers and workstations? If your resources for storage are unlimited, sure! Unfortunately, this is likely never the case. The rule of thumb here is to collect enough logs from your critical systems and infrastructure to accomplish successful reconstruction of events on your network. To start, some events you will want to correlate are: Domain Controller security logs, including authentication events. DNS queries (specifically A record lookups, if possible). DHCP lease events. PowerShell usage. Process Creation events. Any logging from systems used to remotely connect into your network. Web server logs from IIS, Apache, or your webserver of choice. Administrative events from your networking equipment, including wireless connection events. The key is to keep your indexes clean. Think of your indexes as a collection of buckets for your logs. Combining your inputs is the equivalent of mixing your car’s oil collection pan with the water you just pulled from the well. Things swirl around, mix up, and get messy. In the end no one has any idea what is in there, but everyone knows it is useless. Selecting Your Artifacts With that being said, it’s time to think about the most efficient use of the data being aggregated. I don’t know about you, but going into your log aggregator of choice with a list of event codes sounds pretty daunting, and likely will lead to the process getting lost in the fray as other “more important” operational tasks take priority. The answer is to assemble a carefully curated dashboard with key artifacts ready for review. Tools such as Splunk have some excellent built-in visualization capabilities to digest the information as easily as possible (pie charts, tables, etc). A great reference point to get started with is article on the topic of detecting penetration testers on your network. A good penetration test will simulate the actions of an intruder in a controlled fashion, and hone in on some key criteria to detect lateral movement in your network. This includes: this SANS Reading Room User account lockouts. Failed VPN login attempts. Failed Windows logins. Modifications to sensitive groups (Domain Admins especially). Crawling on C$ and ADMIN$ shares. Log file deletion. These are all common actions a threat may take to work their way through your network, and should absolutely be raising some eyebrows with your ops teams. I urge you to take a look at the cited reference below, and think to how you can apply these items to your own infrastructure. SANS is a fantastic resource for everything Incident Response and Cybersecurity, and will very likely be a part of your research journeys. Implementing The Process Here’s the fun part (sarcasm, obviously); it’s time to document the process. The unfortunate truth for us tech minded folks is that unless there is a documented policy and procedure, there might as well be no process at all. When an auditor inevitably gives your office a ring and requests a kickoff meeting, you will need to prove the work that was done. Outline the policy describing what requirements are being fulfilled here. If you made it this far into the article, you likely have a business reason for why this process must be performed, and it should be clearly noted. From there, outline the procedure explaining: Who is responsible for performing the task. How frequently the task is going to be performed. What artifacts are going to be evaluated. Describe your escalation process if something looks suspicious, such as who you will contact. How you will document that the process was performed. When it comes to tracking your actions, don’t think too hard on it. Leverage your existing ticket tracking or change management system (you do have one… right?) or establish a tracking form/spreadsheet to document your findings. Finally, do your peer review and get the sign-off needed to make it official. Meeting security requirements in your network can be a tough task, and ambiguously worded guidance doesn’t make things much easier. Hopefully this article has provided you with a place to start when making your organization safer and more compliant in the realm of event log auditing. Having that level of transparency and insight into your network may be the most valuable defense against the ever-changing threat landscape. Thanks for reading! My goal is to help individuals and organizations tackle complex cybersecurity challenges, and bridge policy into operations. Comments or critiques? Reach me on , , email — jeremy.trinka[at]gmail[dot]com, or reply below. LinkedIn Twitter

Event Log Auditing, Demystified

Log management and SIEM are not discussed by non-technical persons and are known not more. If we go further many things can generate log files such as firewalls, routers, operating systems, etc. but the question is, how do you identify the presence of log messages, records or any kind of trails? As there are hundreds and thousands of generated log files and it is necessary to detect them. So for the sake of your security, you should keep log monitoring tools up to date. There are various available in the market and you can choose them as per your convenience because every tool is designed for a purpose and each one differs from other. log management tools So in this blog, we will discuss several which are running successfully in the geeky market and sturdy as hell. But before comparing them let us understand log management a little. log management tools Log management handles large volumes of computer-generated log messages. These messages are also famous for audit records, audit trails, event-logs, etc. What they do is: Log collection Centralized log aggregation Long-term log storage and retention Log rotation Real-time and in bulk after storage log analysis Log search and reporting As a simple practice, you should gather all the data at one place. Check it and you will get the information, and that is what you want correctly. Because what would you do with the data? There will be an enormous amount of it and it’s useless if you don’t know what it is. Now, to manage them is necessary and for that you will need various log tools. See how complicated it is? So let’s check it out which tools can support your complications in managing the log files. Motadata processes any type of data on any of the given formats as well as coming from any of the sources. It comes with HIDS, SIEM, integrity of files and intrusion detection. Motadata Motadata software platform is highly scalable and flexible with centralized aggregation. It protects your confidential data and avoids unauthorized entry or access to your files and folders. It detects security breaches very swiftly. Motadata data model driven log monitoring platform comes with Centralized Log Management Log Correlation Agentless or Agent-based collection Compliance Reporting Aggregates multiple heterogeneous resources Normalize Log Data Full text search with raw messages Any Device/Server/App/Text With Motadata, we provide the ideal solution required to perfectly manage the problems of today’s increasingly multifaceted business operations and IT infrastructure administration. And the best thing is that we at Motadata are currently offering you a 30 day free trial offer of our Log management software platform, so explore Motadata right now. 2. Splunk . Splunk enterprise provides you operational intelligence from your machine-generated data. It comes with a range of search, visualization, and pre-packaged content for use-cases that any user can explore to discover and share insights. Splunk also has built-in reporting capabilities with advanced charts and dashboards and a pivot interface to generate visual reports with drag-and-drop ease. It serves you when you especially require Real-time search, analysis and visualization Comfortable built in alerting and reporting Easy manual configurations for charts and dashboards Also splunk has some of the major cons It is more subjective being an on-premise solution which leads to a setup cost. It is complex to deal with and need deployment in a high-scale environment. You will require installing and configuring with a dedicated cluster. So for taking advantages of this platform you need to set up all the sources manually that is a little complex, costly and time consuming. 3. LogPacker LogPacker is especially made in two versions for different uses: Standalone and Cloud. Standalone version shows collaborations of agents and servers. It runs on Unix, Windows, Android and iOS. While server stores logs from all agents and saves them at one storage location. It provides a full web interface with dashboards and search functions. Splunk and LogPacker both perform almost at the same stage but they conquer each other in various fields. You are supposed to set up all the resources in Splunk while LogPacker has built in support for more than 100 sources for logs. Splunk is far easy and better than LogPacker when it comes to visual interface. Splunk has the easiest interface to handle while LogPacker does not hold specific interface. So LogPacker helps you a lot in: In finding sources of the logs because it supports up to 100 sources which are available It gives you multiple storage options It provides and enables alerts via your email or SMS However with some of the cons: Standalone version do not have any built-in web interface The free version has limitations and caters only up to 5 servers in the cluster 4. Loggly is another cloud-based log management service which penetrates the roots of log data in real-time while giving you the most crucial information, on how to improve your code and deliver a better customer experience. It has a flagship log data collection means that you can use traditional standards like HTTP and Syslog. It is actually very light weight and totally free if you are willing to test it, It will surely please you as it can dive too deep in the ocean of data that even big and reputed tools cannot do it sometimes. It also comes in three more variants standard, pro and enterprise. Loggly It doesn’t make that much difference between three discussed log management tools. A little change can acquire you efficiency and depends on the matter of choice. It also gives you facilities in cloud version, but if you use LogPacker for this requirement then it will give you better results than Loggly. Cons Not transparent in configuration or in sources configuration Not flexible in cloud infrastructures Not fully secure 5. LOGENTRIES As we said previously the procedure to collect all the log files at one place, Logentries is the perfect example for it. Just as a simple task it automatically collects and centralizes all the log data in any format at one location where you can search, aggregate, and visualize log data to get answers to your questions, in seconds. Simple, isn’t it? We found this log management tools the best, simple and secure. The pros include aggregated live tail search, Custom tags of logs, Email reports, supports a diverse set of programming languages and offers decent documentation. Cons The same manual installation and manual log sources management There’s a limit of 100 logs per server Can’t track the source of errors in 3rd party libraries Insufficiently secure web client logger No specialized reporting for JavaScript Key Takeaways So that was it readers. There are numerous available in the market right now and even those tools might give a tough competition. These are the good performers at overall scales. We have shown them best as per the requirements of the consumer. So we hope that it will make your complexions easy. log management tools

Choosing the Best Log Management Tool for Your System

Using Git & GitHub to Save Your Code When I was very young, I somehow stumbled into the world of C++ and put together the perennial favorite "Hello World" program. I compiled it, executed it, and got the pop-up confirming a successful foray into "programming." I, however, never went much further than that because as a 12-year-old, my version control process....sucked. I would lose the source code, then come back to it a week later and make a new file all over again. I would play around and make progress doing little things with C++, but every time I did so, it was basically starting from scratch because I was so bad at maintaining control of my source code. Nothing will kill your ambitions to work with code faster than losing all your progress every time you 'build. The solution to this problem is Git, or in this case, specifically GitHub. We will now take this little Terraform deploy from Part 3 and put it into GitHub using a few basic Git commands on the built-in terminal in VSCode (there is a VSCode Github extension to do this, but it’s best that you understand what Git commands are used to achieve this type of task before relying on an extension to do it for you). You could also use your OS’s native terminal (CMD, Powershell, ZSH, whatever) for these steps. Open the terminal in VSCode by hitting "CTRL + `" (thats a backtick, the little key to the left of "1") In this new terminal, verify that you are in the correct file directory (it should be by default). In the next step, we will initialize a Git repo in this folder and start tracking changes to your code. If this isn't the directory where your code is, change it to the correct directory. We now want to initialize Git; to do this type: git init Git is now running in this directory, however, it isn't tracking any files (or code in those files). Git can use local code repositories as well as remote code repositories (“repo”). In most professional settings, you will be using a remote repo with a service like Github, Gitlab, Bitbucket, etc… We need to tell Git where to send this code we are about to have it tracked. To do that, we use the . git remote add The syntax for this looks like this: git remote add origin https://github.com/owner/repo_name.git breaking this down: instructs git to add a remote repo named “origin” and use the URL after it as the destination for this remote repo git remote add origin In my case, I have created a new (empty) repo on GitHub under my account so it looks like this: git remote add origin https://github.com/wellmadeoldfashioned/YT-single-server-arch-AWS.git Now, we can move on to telling git to “track” files. To track a specific file, we can do: OR to track everything in the current repo, you can do: - it’s usually best to be explicit and add individual files and not track all files in a local directory. git add [filename] git add . Let’s now add our terraform file; issue the following command to do that: git add main.tf At this point, the file or files you added in the previous step are now “staged” - all this means is you have told Git to “take a copy of these files as they are now and get ready to send the copies to a repo” (in this case, a remote repo: Github). Once the files are staged, we need to create a commit - think of it like a checkpoint in your development progress where you can add a short message describing the checkpoint. To stage a commit, we use - it’s tradition that on the first commit, you use something like “initial commit,” but there are no rules dictating what goes into the message. Generally speaking, you want to be concise and descriptive. For example, if this was a commit that updated a variable name, we would say just that git commit -m “[message_goes_here]” git commit -m “updated AMI variable to XYZ” Now issue: - you should receive a few lines of feedback from Git that look like this: git commit -m “initial commit” This is almost complete, but not quite yet. We have initialized Git, added a remote repo, instructed Git to track a specific file, and staged a commit to the remote repo, but we have not yet the commit to the remote repo. sent To send the commit (your "checkpoint” we created above using the Git commit command), you need to issue git push [remote-repo-name] [local-branch-name] To figure out the remote repo name, we need to look back at step 4 to see what we named it, in this case, “origin.” To figure out the local branch name, you can either issue , OR if you didn’t change it from its default setting, it will be “master” for the master branch. git branch As you can see, we are indeed working on the master branch locally. So, to push the code to Github, we need to issue: git push origin master Checking on the GitHub side, we can see the commit I just sent. As well as the actual commit changes: Hopefully, this helps get you started with Git and GitHub. In this working demo, there were some shortcuts taken for the sake of simplicity (like not creating a new branch to preserve the master branch, not merging changes, forking, etc.), but this knowledge is the foundation for learning those things. Once you have comfortability established using Git in this fashion, you should move on to working on different branches, understanding what the “HEAD” is and how to manipulate it, forking repos, merging changes, etc…

Stories, News & Mentions about SPLUNK

Splunk’s Stories on HackerNoon

Splunk's News & Mentions