Skip to content

Commit f70329b

Browse files
derkkiladerkkila
committed
Update Docs
Updating Docs to refer to official Splunk Add-on for GitHub. Removing built in documentation in favor of official docs and references to GitHub repo documentation.
1 parent e166499 commit f70329b

File tree

5 files changed

+5
-373
lines changed

5 files changed

+5
-373
lines changed

‎docs/ghe_audit_logs.MD

Lines changed: 1 addition & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,13 @@
11
# GitHub Enterprise Audit Log Monitoring
22

3-
> Splunk modular input plugin to fetch the enterprise audit log from GitHub Enterprise
4-
5-
Support for modular inputs in Splunk Enterprise 5.0 and later enables you to add new types of inputs to Splunk Enterprise that are treated as native Splunk Enterprise inputs.
6-
7-
This modular input makes an HTTPS request to the GitHub Enterprise's Audit Log REST API endpoint at a definable interval to fetch audit log data.
8-
9-
![Splunk modular input demo](./images/C70F5295-D9FA-48FC-90CA-A7BD397AEC35.png)
10-
113
## Prerequisites
124

135
- Splunk v8.x+
146
- Python 3.x
157

168
## Installation
179

18-
1. SSH to your Splunk server
19-
20-
2. Download the latest release from [Releases](https://github.com/splunk/github-audit-log-monitoring-add-on-for-splunk/releases)
21-
22-
3. Copy the tarball to the apps directory and extract it:
23-
24-
```sh
25-
$ cp splunk-ghe-audit-log-monitoring-<VERSION>.tar.gz $SPLUNK_HOME/etc/apps/
26-
27-
$ mkdir -p $SPLUNK_HOME/etc/apps/ghe_audit_log_monitoring
28-
29-
$ tar xf $SPLUNK_HOME/etc/apps/splunk-ghe-audit-log-monitoring-<VERSION>.tar.gz -C $SPLUNK_HOME/etc/apps/ghe_audit_log_monitoring --strip-components=1
30-
31-
# Optional depending on the user executing the previous actions
32-
$ sudo chown -R splunk:splunk $SPLUNK_HOME/etc/apps/ghe_audit_log_monitoring
33-
34-
# Make the state directory writable by the group
35-
$ sudo chmod -R 775 /opt/splunk/etc/apps/ghe_audit_log_monitoring/state
36-
```
37-
38-
4. Restart the Splunk server
39-
40-
5. Generate a Personal Access Token in GitHub.com (PAT must be generated by an Enterprise Owner).
41-
42-
6. Configure and the GitHub Enterprise Audit Log Monitoring by entering the necessary information in the input fields
10+
Installation and configuration documents for the (Splunk Add-on for GitHub)[https://docs.splunk.com/Documentation/AddOns/released/GitHub/About] is available in our official Splunk docs. This add-on can be used for both GitHub Enterprise Cloud and Server. To configure for each specific environment, please refer to the official docs.
4311

4412
## Configuration
4513

@@ -155,30 +123,3 @@ If you've enabled debug mode be ready to change your personal access token becau
155123
### Why can't I use a GitHub app instead of a personal access token?
156124

157125
GitHub apps cannot be installed on the enterprise level. The REST API requires enterprise admin privileges which are out of scope for GitHub apps.
158-
159-
## Troubleshooting
160-
161-
### Read logs in Splunk
162-
163-
You can use this search query to fetch all the logs belonging to this module when **Debug Mode** is enabled.
164-
165-
```sh
166-
index="_internal" source="/opt/splunk/var/log/splunk/splunkd.log" ghe_audit_log_monitoring
167-
```
168-
169-
### Test the modular input for syntax problems
170-
171-
Run this test if you don't see anything in the logs (which is a highly unlikely scenario). This will display any syntax errors if there are any.
172-
173-
```sh
174-
sudo $SPLUNK_HOME/bin/splunk cmd python $SPLUNK_HOME/etc/apps/ghe_audit_log_monitoring/bin/ghe_audit_log_monitoring.py
175-
```
176-
177-
### Where are state files stored?
178-
179-
State files for enterprises are stored in this directory:
180-
181-
```sh
182-
$SPLUNK_HOME/etc/apps/ghe_audit_log_monitoring/state/
183-
```
184-
Test

‎docs/ghes_syslog_setup.MD

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
# Sending GitHub Enterprise Server Logs to Splunk
22

3-
GitHub Enterprise Server comes with syslog-ng built in to send data to platforms like Splunk: https://docs.github.com/en/enterprise-server@3.3/admin/user-management/monitoring-activity-in-your-enterprise/log-forwarding. Following those directions will allow you to easily onboard logs to Splunk. To take advantage of GitHub Enterprise Server's built in syslog, you can direct GHES to a Splunk Connect for Syslog endpoint which has built in capability to parse GitHub Enterprise Server logs. Pairing that with the [Splunk Add-On for GitHub](https://splunkbase.splunk.com/app/6254/) will enable proper field extractions and field aliases.
3+
GitHub Enterprise Server comes with syslog-ng built in to send data to platforms like Splunk and we can take advantage of that with the (Splunk Add-on for GitHub)[https://splunkbase.splunk.com/app/6254/]. Setup details and documentation is available on (Splunk Docs)[https://docs.splunk.com/Documentation/AddOns/released/GitHub/About].

‎github_app_for_splunk/default/data/ui/views/api_config.xml

Lines changed: 0 additions & 232 deletions
This file was deleted.

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy