Vulners App for Splunk

Vulners Application for Splunk allows one to use Splunk as a Vulnerability assessment platform and security scanner.

Notes

The app was tested in a simple installation as well as in a clustered (search head cluster) installation
As a result it is a whole package that includes parts for three Splunk components: forwarders, indexers (indexer cluster) and search heads (search head clusters).

Installation

Installation process is described in details within the app directory

Usage

1. Search for packages collected using python scripted input from the app

By default scripted input is sending information about packages hourly. You must enable it before it starts to collect the data. To see collected packages run search

index=vulners

2. Ad-hoc Vulners audit request

Vulners application is running audit script automatically at 9 o'clock in the morning. You must enable it before it starts to work. Alternatively you can hit saved search

| savedsearch vulners_report

Using slim

Install slim as in the instruction (take note of this bug though)
Create a package

slim package -o result/ ./vulners-lookup/