Firegen Analytics – Cybersecurity Consulting and Analytics

Configuring rsyslog to split the logs by device IP and rotate the logs on daily basis
The following steps apply to a new installation of Ubuntu 16, with the default rsyslog settings
1. Modify the rsyslog configuration file, /etc/rsyslog.conf and uncomment the settings for the UDP listener:...

Moving an index from one Splunk instance to another
Moving indexes in Splunk can be required in migrations, upgrades or simply as an exercise for backup and restores.
In this example, we will move an index called SSG from a Splunk 7.02 server called UBUNTU07 running on Ubuntu Linux to another 7.02 Splunk server running on another Ubuntu server called SPLUNKOSAUR. We are assuming that Splunk is installed in the default...

Firegen provides a command-line version of the analysis engine that can be used to scripting or scheduling with special requirements that exceeds the default scheduler service. Firegen40CLI will also provide a more verbose output and it may be helpful...

The Firegen scheduler settings provide the option to specify the analysis time and interval using a cron expression. Cron is long used Unix-based command line job scheduler that provides a wide range of options on scheduling a certain task. Quartz, the...