[Dies gilt für v4.0.x der Recorded Future App für Splunk Enterprise]

Fehlerbehebung

In der App sind eine Reihe von Berichten verfügbar, die bei der Fehlerbehebung helfen können.

How to use the reports

All logs from the App

The report lists all the events created by the app. The loglevel can adjusted in Configuration -> Global configuration under the Logging pane. Default is INFO but when troubleshooting it may be apropriate to increase the level to DEBUG.

A good starting place is to look for errors (loglevel ERROR). To facilitate searching it's possible to open the report in the search view (select "Open in Search" via the "Edit" button).

Latest updates of all risklists

This report lists all the risklists that have been retrieved successfully from Recorded Future. If a list is missing from the view this means that it has not been updated during the last 24 hours.

If it is necessary to expand the search period this can be done by opening the report in Search.

The update frequency of a risk list depends on how often it is regenerated on Recorded Future's system. The default risklists pre-configured by Recorded Future are updated at two different intervals:

• IP-, Domain- und URL-Risikolisten werden stündlich aktualisiert
• Hash- und Schwachstellen-Risikolisten werden täglich aktualisiert

Wenn eine Risikoliste in der Ansicht fehlt, kann es notwendig sein, zu prüfen, ob sie in der Fusion-API zu finden ist. Weitere Informationen finden Sie unter Fehlerbehebung bei Fusion-Dateien weiter unten.

Validate app deployment

This report should be reviewed after app deployment to verify that the configuration works.

The built-in validator perform a number of tests and collect useful troubleshooting information. Normally only statuses of Ok or NA should be present. Investigate any Warning or Error, these will have useful suggestions for troubleshooting.

Other troubleshooting tips

Troubleshooting Fusion Files

Fusion files are used as risklists in the app. If a configured risklist fails to be retrieved this can be due to a number of reasons.

1. If all risklists fail to update there's most likely an issue with network connectivity or the api key used. Run the "Validate app deployment" report.
2. Die Fusion-Datei existiert möglicherweise nicht, oder sie wurde falsch geschrieben. Dies kann durch die folgende Suche überprüft werden: index=_* sourcetype="tarecordedfuture:cyber:log" ERROR 404 "File or directory" path=*
   1. Schauen Sie sich das Pfadfeld an, das die URL-kodierte Version des Fusion-Dateipfads ist (ex /home/custom.csv liest %2Fhome%2Fcustom.cvs). Stellen Sie sicher, dass es sich um eine Fusion-Datei handelt.
   2. Ensure that the api key used by the app belongs to the correct enterprise in Recorded Future's system. With the exception of public Fusion files (paths starting with /public/) no Fusion files. are available outside of the Enterprise.
   3. Ensure that the Fusion Flow responsible for generating the Fusion file was successfully executed.

Further help

Your Recorded Future Intelligence Services consultant would be happy to help you with additional questions and advice.  If you do not know who that is, you can also contact support@recordedfuture.com.

Bitte wenden Sie sich nicht an den Splunk-Support bezüglich "Recorded Future for Splunk Enterprise".