Skip to content
This repository was archived by the owner on May 19, 2023. It is now read-only.

Commit c51cc10

Browse files
authored
Remove splunklib directories (#483)
- Remove `splunklib` directories from `clx_query` and `splunk2kafka` to address CVE found with `splunk-sdk-python_1.6.2`. - READMEs for both apps were updated to require `splunklib` from `splunk-sdk-python` repo to be manually copied to Splunk app. - Fixed bad links in README. Closes #480 Authors: - Eli Fajardo (https://github.com/efajardo-nv) - Ray Douglass (https://github.com/raydouglass) Approvers: - https://github.com/bsuryadevara - Bartley Richardson (https://github.com/BartleyR) URL: #483
1 parent e3da552 commit c51cc10

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+17
-21443
lines changed

CHANGELOG.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,11 @@ Please see https://github.com/rapidsai/clx/releases/tag/v22.06.00a for the lates
44

55
# clx 22.04.00 (Date TBD)
66

7-
Please see https://github.com/rapidsai/clx/releases/tag/v22.04.00a for the latest changes to this development branch.
7+
## 🛠️ Improvements
8+
9+
- Temporarily disable new `ops-bot` functionality ([#478](https://github.com/rapidsai/clx/pull/478)) [@ajschmidt8](https://github.com/ajschmidt8)
10+
- Add `.github/ops-bot.yaml` config file ([#477](https://github.com/rapidsai/clx/pull/477)) [@ajschmidt8](https://github.com/ajschmidt8)
11+
- removed deprecated function to_array ([#474](https://github.com/rapidsai/clx/pull/474)) [@bsuryadevara](https://github.com/bsuryadevara)
812

913
# clx 22.02.00 (2 Feb 2022)
1014

siem_integrations/README.md

+9-10
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
# <div align="left"><img src="../img/rapids_logo.png" width="90px"/>&nbsp;CLX SIEM Integration</div>
22

3-
**NOTE:** For the latest stable [README.md](https://github.com/rapidsai/clx/blob/main/README.md) ensure you are on the `main` branch.
4-
53
[RAPIDS](https://rapids.ai) CLX [SIEM](https://en.wikipedia.org/wiki/Security_information_and_event_management) Integrations provide features that enable interoperability between SIEMs and a RAPIDS/CLX environment. Currently, this support includes `splunk2kafka`, enabling data integration between Splunk and CLX.
64

75
## Splunk2Kafka
@@ -15,15 +13,15 @@ Use this Splunk query template to send data to your Kafka instance.
1513
index="my-index" | export2kafka topic=my-topic broker=10.0.0.0:9092
1614
```
1715

18-
Additional query configuration options are detailed [here](https://github.com/rapidsai/clx/blob/main/splunk2kafka/export2kafka/README.md).
16+
Additional query configuration options are detailed [here](splunk2kafka/export2kafka/README.md).
1917

2018
### Install Splunk2Kafka
2119

2220
Install the following applications into your Splunk instance by following the instructions linked below.
2321
In order to utilize splunk2kafka, a [running Kafka instance](https://kafka.apache.org/quickstart) is required.
2422

25-
1. Install splunk_wrapper ([Instructions](https://github.com/rapidsai/clx/blob/main/splunk2kafka/splunk_wrapper/README.md))
26-
2. Install export2kafka ([Instructions](https://github.com/rapidsai/clx-siem-integration/blob/main/splunk2kafka/export2kafka/README.md))
23+
1. Install splunk_wrapper ([Instructions](splunk2kafka/splunk_wrapper/README.md))
24+
2. Install export2kafka ([Instructions](splunk2kafka/export2kafka/README.md))
2725

2826

2927
## CLX Query
@@ -99,22 +97,23 @@ Download MovieLens stable benchmark [dataset](https://grouplens.org/datasets/mov
9997
```aidl
10098
cp -R clx_query splunk/etc/apps
10199
```
102-
3. Restart splunk application server to take effect on changes.
100+
3. Copy `splunklib` from [splunk-sdk-python](https://github.com/splunk/splunk-sdk-python) to splunk apps directory. Use tag version that matches your Splunk installation. *Note: Application was tested with Splunk 1.6.x*.
101+
4. Restart splunk application server to take effect on changes.
103102
```aidl
104103
./splunk/bin/splunk restart
105104
```
106-
4. Login to Splunk GUI and launch CLX Query application. `Apps> Manage Apps> Clx Query> Launch App`
107-
5. Run sample query
105+
5. Login to Splunk GUI and launch CLX Query application. `Apps> Manage Apps> ClX Query> Launch App`
106+
6. Run sample query
108107
- Get number of user_id's and their average rating in descending order for each genre and title. Consider movies only with rating greater than 2.5.
109108
```
110109
| clx query="SELECT genres, title, avg(rating) as avg_rating, count(user_id) as user_cnt from (SELECT main.movies.title as title, main.movies.genres as genres, main.ratings.userId as user_id, main.ratings.rating as rating FROM main.movies INNER JOIN main.ratings ON (main.ratings.movieId = main.movies.movieId) WHERE main.ratings.rating > 2.5) as tmp GROUP BY genres, title ORDER BY user_cnt DESC, avg_rating DESC"
111110
```
112111
113112
![clx_query_screeshot](/siem_integrations/clx_query/clx_query.png)
114113
115-
### Know Issues
114+
### Known Issues
116115
1. Columns not being inferred from CSV header [blazingsql-265](https://github.com/BlazingDB/blazingsql/issues/265).
117116
118117
## Contributing Guide
119118
120-
Review the [CONTRIBUTING.md](https://github.com/rapidsai/clx/blob/main/CONTRIBUTING.md) file for information on how to contribute code and issues to the project.
119+
Review the [CONTRIBUTING.md](../CONTRIBUTING.md) file for information on how to contribute code and issues to the project.

siem_integrations/clx_query/bin/splunklib/__init__.py

-19
This file was deleted.

0 commit comments

Comments
 (0)