# searchbnf.conf [trackme-command] syntax = | trackme url= mode= params= body= description = \ This command is a REST API wrapper for TrackMe API endpoints, it allows performing \ get / post / delete HTTP calls against an endpoint and returns a JSON format answer. \ Syntax: \ | trackme url= mode= params= body= comment1 = \ This example calls the smart_status endpoint to provide an advanced status with automated \ correlations and investigations. example1 = \ | trackme url=/services/trackme/v2/splk_smart_status/ds_smart_status mode=get body="{'object': 'firewall:pan:traffic'}" shortdesc = REST API wrapper for TrackMe, allows performing \ get / post / delete HTTP calls against an endpoint. usage = public tags = trackme [trackmegetconf-command] syntax = | trackmegetconf target= description = \ This command is a simple generating command to retrieve the application level configuration stanzas, parameters and values Syntax: \ | trackmegetconf target= comment1 = \ This example retrieves all parameters and values for the trackme_general configuration items example1 = \ | trackmegetconf target=trackme_general shortdesc = Retrieve TrackMe application level configuration parameters and values usage = public tags = trackme # Performs remote search to any Splunk instance over REST, using a bearer token and an account configured [splunkremotesearch-command] syntax = | splunkremotesearch account= search= earliest= latest= component= register_component= tenant_id= report= run_against_each_member= report_runtime= sample_ratio= description = \ This command is a REST remote search for Splunk, it allows performing \ any search to a remote Splunk deployment and returns a JSON format answer. \ Syntax: \ | splunkremotesearch account= search= earliest= latest= component= register_component= tenant_id= report= run_against_each_member= report_runtime= sample_ratio= comment1 = \ This example performs a simple magic search to a remote Splunk deployment example1 = \ | splunkremotesearch account=acme_splunk search="| tstats max(_indextime) as data_last_ingest, min(_time) as data_first_time_seen, max(_time) as data_last_time_seen, count as data_eventcount, dc(host) as dcount_host where index=\"firewall\" | eval object=\"test\", data_index=\"test\", data_sourcetype=\"pan:traffic\", data_last_ingestion_lag_seen=data_last_ingest-data_last_time_seen" earliest="-4h" latest="+4h" shortdesc = REST remote search for Splunk, it allows performing \ any search to a remote Splunk deployment and returns a JSON format answer. usage = public tags = trackme # The Data Sampling mass executor [trackmesamplingexecutor-command] syntax = | trackmesamplingexecutor tenant_id= mode= object= earliest= latest= get_samples_max_count= max_runtime= regex_expression= model_type= model_name= sourcetype_scope= description = \ This command is the TrackMe data sampling mass job executor \ Syntax: \ | trackmesamplingexecutor tenant_id= mode= object= earliest= latest= get_samples_max_count= max_runtime= regex_expression= model_type= model_name= sourcetype_scope= comment1 = \ This example performs the mass data sampling main job example1 = \ | trackmesamplingexecutor tenant_id="my_tenant" shortdesc = TrackMe Data Sampling mass executor job usage = public tags = trackme # The Elastic Sources shared mass executor [trackmeelasticexecutor-command] syntax = | trackmeelasticexecutor tenant_id= component= margin_sec= max_concurrent_searches= description = \ This command is the TrackMe Elastic Sources shared mass job executor \ Syntax: \ | trackmeelasticexecutor tenant_id= component= margin_sec= max_concurrent_searches= comment1 = \ This example performs the Elastic Sources shared mass main job example1 = \ | trackmeelasticexecutor tenant_id="mytenant" component="dsm" shortdesc = TrackMe Elastic Sources shared mass executor job usage = public tags = trackme # Performs the controled and monitored execution of a Trackme tracker [trackmetrackerexecutor-command] syntax = | trackmetrackerexecutor tenant_id= component= report= args= earliest= latest= alert_no_results= force_savedsearch_execmode= description = \ This command is a Python wrapper to execute TrackMe trackers jobs in a controled and monitored manner \ Syntax: \ | trackmetrackerexecutor tenant_id= component= report= args= earliest= latest= alert_no_results= force_savedsearch_execmode= comment1 = \ This is an example of a TrackMe tracker execution. example1 = \ | trackmetrackerexecutor tenant_id="mytenant" component="splk-dsm" report="trackme_dsm_hybrid_tracker-39858981_wrapper_tenant_feeds-secops" earliest="-4h" latest="+4h" shortdesc = Python wrapper to execute TrackMe trackers jobs in a controled and monitored manner usage = public tags = trackme # Load the TrackMe tenant root content [trackmeload-command] syntax = | trackmeload mode= description = \ This command retrieves the tenant root content, depending on the roles membership from the user running the command \ Syntax: \ | trackmeload mode= comment1 = \ This example retrieves the tenant JSON data according to the user's roles membership example1 = \ | trackmeload shortdesc = Python wrapper to retrieve the tenant JSON data according to RBAC usage = public tags = trackme # Load the TrackMe tenant status summary [trackmetenantstatus-command] syntax = | trackmetenantstatus tenant_id= output= description = \ This command retrieves the tenants status summary data, and renders to be investigated easily in Splunk \ Syntax: \ | trackmetenantstatus tenant_id= output= comment1 = \ This example retrieve the summary status data for all tenants example1 = \ | trackmetenantstatus output="status" shortdesc = Python wrapper to retrieve tenants status summary data usage = public tags = trackme # get flipping events [trackmesplkgetflipping-command] syntax = | trackmesplkgetflipping tenant_id= object_category= description = \ This command is used to generate flipping status events using the TrackMe libs trackme_audit_flip function \ Syntax: \ | trackmesplkgetflipping tenant_id=the tenant identifier> object_category= | spath | fields - _raw comment1 = \ This example filters the blocklist for splk-dsm example1 = \ | trackmesplkgetflipping tenant_id="mytenant" object_category="splk-dsm" | spath | fields - _raw shortdesc = Generate flipping statuses events usage = public tags = trackme # get flipping events [trackmeacktracker-command] syntax = | trackmeacktracker tenant_id= action= description = \ This command is used to manage the Acknowledgment expiration, it is a generating command which will read all Ack collections and expire acknowlegements records as needed \ Syntax: \ | trackmeacktracker tenant_id= action= comment1 = \ This example manages acknowlegements expiration for all tenants example1 = \ | trackmeacktracker shortdesc = Handles the acknowlegment expiration for tenant collections usage = public tags = trackme # manually generate a new notable event [trackmegennotable-command] syntax = | savedsearch | trackmegennotable notable_title= description = \ This streaming command can be used to manually generate a new notable event \ Syntax: \ | savedsearch | trackmegennotable notable_title= comment1 = \ This example generate a new notable event example1 = \ | savedsearch "TrackMe alert tenant_id:mytenant - Alert custom on data_source" | trackmegennotable shortdesc = Manually generate a new TrackMe notable event usage = public tags = trackme # TrackMe streaming summary events custom command [trackmecollect-command] syntax = | trackmecollect index= source= sourcetype= description = \ This streaming command can be used to manually generate a new notable event \ Syntax: \ | trackmecollect index= source= sourcetype= comment1 = \ This example generate a new notable event example1 = \ | trackmecollect index="trackme_summary" source="current_state_tracking:splk-dsm:mytenant" sourcetype="trackme:state" shortdesc = Generate and index TrackMe summary events usage = public tags = trackme # TrackMe generating health tracker custom command [trackmetrackerhealth-command] syntax = | trackmetrackerhealth tenant_id= get_acl= description = \ This generating command is designed to execute the health tracker component for the tenant \ Syntax: \ | trackmetrackerhealth tenant_id= get_acl= comment1 = \ This example tracks the health of the tenant example1 = \ | trackmetrackerhealth tenant_id="mytenant" get_acl=True shortdesc = Tracks the health status of a TrackMe tenant usage = public tags = trackme # Streaming command to load and pretty print json fields [trackmeprettyjson-command] syntax = | trackmeprettyjson fields= remove_nonpositive_num= remove_null= merge= merge_field_target= description = \ This streaming command can be used to pretty print a list of JSON fields \ Syntax: \ | trackmeprettyjson fields= remove_nonpositive_num= remove_null= merge= merge_field_target= comment1 = \ This example pretty prints the field job_component_register example1 = \ | trackmeprettyjson fields="job_component_register" shortdesc = Pretty print a list of JSON fields usage = public tags = trackme # Generating command to yield a JSON value [trackmeyieldjson-command] syntax = | trackmeyieldjson json_value= description = \ This generating command can be used to yield a JSON value \ Syntax: \ | trackmeyieldjson json_value= comment1 = \ This example yields a JSON value example1 = \ | trackmeyieldjson json_value="{\"key1\": \"value1\", \"key2\": \"value2\"}" shortdesc = Yield a JSON value usage = public tags = trackme # Streaming command to expand the job component register [trackmeopsstatusexpand-command] syntax = | trackmeopsstatusexpand description = \ This command retrieves and expands the job component register \ Syntax: \ | trackmeopsstatusexpand comment1 = \ This command retrieves and expands the job component register example1 = \ | trackmeopsstatusexpand shortdesc = Retrieve and expand the job component register usage = public tags = trackme # Streaming command to set splk outliers rules [trackmesplkoutlierssetrules-command] syntax = | trackmesplkoutlierssetrules tenant_id= component= description = \ This streaming command is called to generate the splk outliers rules \ Syntax: \ | trackmesplkoutlierssetrules tenant_id= component= comment1 = \ This example generates splk outliers rules for splk-dsm example1 = \ | trackmesplkoutlierssetrules tenant_id="mytenant" object_category="dsm" shortdesc = Generates the splk outliers rules usage = public tags = trackme # Generating command to train machine learning outliers models for a given entity [trackmesplkoutlierstrain-command] syntax = | trackmesplkoutlierstrain tenant_id= component= object= object_id= model_id= mode= model_json_def= description = \ This generating command is called to train the Machine Learning outliers detections models for a given entity \ Syntax: \ | trackmesplkoutlierstrain tenant_id= component= object= object_id= model_id= mode= model_json_def= comment1 = \ This example trains defined Machine Learning models for a given entity example1 = \ | trackmesplkoutlierstrain tenant_id="mytenant" component="dsm" object="my_entity" example2 = \ | trackmesplkoutlierstrain tenant_id="mytenant" component="dsm" object_id="abc123" shortdesc = Train the splk outliers Machine Learning models usage = public tags = trackme # Generating command to render machine learning outliers for a given entity and a given trained model [trackmesplkoutliersrender-command] syntax = | trackmesplkoutliersrender tenant_id= component= object= object_id= model_id= earliest= latest= lowerbound_negative= auto_correct= mode= model_json_def= allow_auto_train= description = \ This generating command is called to render the Machine Learning outliers detections for a given entity and a given trained model \ Syntax: \ | trackmesplkoutliersrender tenant_id= component= object= object_id= model_id= earliest= latest= auto_correct= mode= model_json_def= allow_auto_train= comment1 = \ This example renders trained Machine Learning outliers for a given entity example1 = \ | trackmesplkoutliersrender tenant_id="mytenant" component="dsm" object="my_entity" earliest="-7d" latest="now" example2 = \ | trackmesplkoutliersrender tenant_id="mytenant" component="dsm" object_id="a23302f92eac2435ad33dba5237bb9e5feed3d6be819cfeb7b88f2c55bc35edd" earliest="-7d" latest="now" shortdesc = Render the splk outliers Machine Learning results usage = public tags = trackme # Generating command to render entities rules [trackmesplkoutliersgetrules-command] syntax = | trackmesplkoutliersgetrules tenant_id= component= object= object_id= model_id= description = \ This generating command is called to render the Machine Learning outliers detections rules \ Syntax: \ | trackmesplkoutliersgetrules tenant_id= component= object= object_id= model_id= comment1 = \ This example renders Machine Learning outliers rules for a given entity example1 = \ | trackmesplkoutliersgetrules tenant_id="mytenant" component="dsm" object="my_entity" example2 = \ | trackmesplkoutliersgetrules tenant_id="mytenant" component="dsm" object_id="a23302f92eac2435ad33dba5237bb9e5feed3d6be819cfeb7b88f2c55bc35edd" shortdesc = Render the splk outliers Machine Learning rules usage = public tags = trackme # Generating command to render entities data [trackmesplkoutliersgetdata-command] syntax = | trackmesplkoutliersgetdata tenant_id= component= object= object_id= description = \ This generating command is called to render the Machine Learning outliers detections data \ Syntax: \ | trackmesplkoutliersgetdata tenant_id= component= object= object_id= comment1 = \ This example renders Machine Learning outliers data for a given entity example1 = \ | trackmesplkoutliersgetdata tenant_id="mytenant" component="dsm" object="my_entity" example2 = \ | trackmesplkoutliersgetdata tenant_id="mytenant" component="dsm" object_id="a23302f92eac2435ad33dba5237bb9e5feed3d6be819cfeb7b88f2c55bc35edd" shortdesc = Render the splk outliers Machine Learning data usage = public tags = trackme # Generating command executing regular training of the entities ML models [trackmesplkoutlierstrainhelper-command] syntax = | trackmesplkoutlierstrainhelper tenant_id= component= max_runtime_sec= description = \ This generating command is called to train and maintain Machine Learning models for TrackMe entities \ Syntax: \ | trackmesplkoutlierstrainhelper tenant_id= component= max_runtime_sec= comment1 = \ This example renders Machine Learning outliers rules for a given entity example1 = \ | trackmesplkoutlierstrainhelper tenant_id="mytenant" component="dsm" shortdesc = Machine Learning models training executor usage = public tags = trackme # Generating command rendering current outliers statuses for the tenant entities [trackmesplkoutlierstrackerhelper-command] syntax = | trackmesplkoutlierstrackerhelper tenant_id= component= object= object_id= max_runtime= force_run= allow_auto_train= description = \ This generating command is called to track the current outliers statuses for models defined in the tenant's entities \ Syntax: \ | trackmesplkoutlierstrackerhelper tenant_id= component= object= object_id= max_runtime= force_run= allow_auto_train= comment1 = \ This example tracks the outliers status for all models defined in tenant's entities example1 = \ | trackmesplkoutlierstrackerhelper tenant_id="mytenant" component="dsm" max_runtime="600" example2 = \ | trackmesplkoutlierstrackerhelper tenant_id="mytenant" component="dsm" object_id="abc123" force_run="True" shortdesc = Machine Learning models tracking executor usage = public tags = trackme # Generating command used to generate search filtering expressions according to allow / block lists of the tenants depending on the context [trackmeblocklistgen-command] syntax = | trackmeblocklistgen tenant_id= component= regex= addprefix= fields= target= store_cache= description = \ This generating command is called to generate filtering expressions according to the tenant and component data set configuration \ Syntax: \ | trackmeblocklistgen tenant_id= component= regex= addprefix= fields= target= store_cache= comment1 = \ This example tracks the outliers status for all models defined in tenant's entities example1 = \ | trackmeblocklistgen tenant_id="mytenant" component="dsm" regex="false" target="allowlist" shortdesc = BlockList filtering expression generator usage = public tags = trackme # Generating command to automatically get the API endpoints documentation [trackmeapiautodocs-command] syntax = | trackmeapiautodocs target= description = \ This generating command automatically generate the list of API endpoints per resource group and lists its configuration information and examples \ Syntax: \ | trackmeapiautodocs target= comment1 = \ This example list all API endpoints with their associated documentation example1 = \ | trackmeapiautodocs target="endpoints" shortdesc = TrackMe API documentation auto-generator usage = public tags = trackme # Generating command to parse search results for splk-flx component [trackmesplkflxparse-command] syntax = | trackmesplkflxparse tenant_id= context= remove_raw= remove_time= description = \ This streaming custom command is designed to parse search results for the purposes of the splk-flx component \ Syntax: \ | trackmesplkflxparse tenant_id= context= remove_raw= remove_time= comment1 = \ This example parses upstream search results for the splk-flx component example1 = \ | trackmesplkflxparse tenant_id="mytenant" shortdesc = TrackMe Splk Flex Objects tracking search parser usage = public tags = trackme # Generating command for spk-flx converging [trackmesplkflxconverging-command] syntax = | trackmesplkflxconverging tenants_scope= object= object_description= group= root_constraint= consider_orange_as_up= remove_extra_attributes= min_pct_for_green= description = \ This generating command is designed to parse search results for the purposes of the splk-flx component and converging trackers \ Syntax: \ | trackmesplkflxconverging tenants_scope= object= object_description= group= root_constraint= consider_orange_as_up= remove_extra_attributes= min_pct_for_green= comment1 = \ This example shows the converging trackers for the splk-flx component example1 = \ | trackmesplkflxconverging tenants_scope="mytenant1,mytenant2" object="sla-service-demo" object_description="Datamodels correlated KPI" group="datamodels" root_constraint="group=datamodels" consider_orange_as_up=True shortdesc = TrackMe Splk Flex Objects converging tracking search parser usage = public tags = trackme # Simple utility to extract stats for splk-dhm [trackmestsummarysplkdhm-command] syntax = | trackmestsummarysplkdhm description = \ This streaming custom command is designed to extract statistics from the dictionnary for splk-dhm entities \ Syntax: \ | trackmestsummarysplkdhm comment1 = \ This example retrieves the tenant JSON data according to the user's roles membership example1 = \ | trackmestsummarysplkdhm shortdesc = Python wrapper to extract statistics from the dictionnary for splk-dhm usage = public tags = trackme # Streaming command to check and preserve persistent fields from conflicting updates, as well as optionally inserting and updating records in the KVstore collection [trackmepersistentfields-command] syntax = | trackmepersistentfields collection= key= update_collection= description = \ This streaming custom command is designed to protect TrackMe persistent fields from conficting updates, as well as optionally replacing the Splunk outputlookup command \ Syntax: \ | trackmepersistentfields collection= key= update_collection= comment1 = \ This example is called by TrackMe in the outputlookup macro example1 = \ | trackmepersistentfields collection="$collection$" key="$key$" update_collection="True" shortdesc = Python wrapper to prevent conflicting updates of TrackMe persistent fields, which can as well replace outputlookup usage = public tags = trackme # Generating command to parse search results for splk-wlk component [trackmesplkwlkparse-command] syntax = | trackmesplkwlkparse tenant_id= context= overgroup= check_last_seen= check_last_seen_field= description = \ This streaming custom command is designed to parse search results for the purposes of the splk-wlk component \ Syntax: \ | trackmesplkwlkparse tenant_id= context= overgroup= check_last_seen= check_last_seen_field= comment1 = \ This example parses upstream search results for the splk-wlk component example1 = \ | trackmesplkwlkparse tenant_id="mytenant" shortdesc = TrackMe Splk Workload search parser usage = public tags = trackme # Streaming command to load a list of fields and stored these and their value into a JSON formated field name metrics [trackmegenjsonmetrics-command] syntax = | trackmegenjsonmetrics fields= add_root_label= target= add_prefix= suppress_suffix= description = \ This streaming command can be used to generate a JSON formated field name metrics taking in input a list of fields \ Syntax: \ | trackmegenjsonmetrics fields= add_root_label= target= add_prefix= suppress_suffix= comment1 = \ This example generates the metrics field for the splk-wlk component for the scheduler example1 = \ | trackmegenjsonmetrics fields="scheduler.count_completed,scheduler.count_execution,scheduler.count_skipped,scheduler.skipped_pct" shortdesc = Generates a JSON formated metrics field from a comma separated list of fields usage = public tags = trackme # Streaming command to retrieve saved searches metadata [trackmesplkwlkgetreportsdefstream-command] syntax = | trackmesplkwlkgetreportsdefstream tenant_id= context= register_component= report= check_orphan= max_runtime_sec= filters_get_last_updates= description = \ This streaming custom command is designed to retrieve Splunk saved searches metadata from upstream results \ Syntax: \ | trackmesplkwlkgetreportsdefstream tenant_id= context= register_component= report= check_orphan= max_runtime_sec= filters_get_last_updates= comment1 = \ This example retrieves Splunk saved searches metadata from upstream results example1 = \ | trackmesplkwlkgetreportsdefstream tenant_id="mytenant" shortdesc = Python wrapper to retrieve Splunk saved searches metadata from upstream results in a streaming manner usage = public tags = trackme # Streaming command to verify the user owner of saved searches and dynamically retrieve the owner if not available in upstream results [trackmesplkwlkgetreportowner-command] syntax = | trackmesplkwlkgetreportowner tenant_id= description = \ This streaming custom command is designed to retrieve the Splunk user owner from upstream results \ Syntax: \ | trackmesplkwlkgetreportowner tenant_id= comment1 = \ This example retrieves the user owner from upstream results example1 = \ | trackmesplkwlkgetreportowner tenant_id="mytenant" shortdesc = Python wrapper to retrieve Splunk saved searches user owner from upstream results in a streaming manner usage = public tags = trackme # Generating command to retrieve saved searches metadata [trackmesplkwlkgetreportsdefgen-command] syntax = | trackmesplkwlkgetreportsdefgen tenant_id= object_name= object_id= description = \ This generating custom command is designed to retrieve Splunk saved searches metadata for a specific search \ Syntax: \ | trackmesplkwlkgetreportsdefgen tenant_id= object_name= object_id= comment1 = \ This example retrieves Splunk saved searches metadata from TrackMe's store for a specific search example1 = \ | trackmesplkwlkgetreportsdefgen tenant_id="mytenant" object_name= shortdesc = Python wrapper to retrieve Splunk saved searches metadata for a specific search in a generating manner # Generating command to manage splk-wlk records to be purged [trackmesplkwlkinactiveinspector-command] syntax = | trackmesplkwlkinactiveinspector tenant_id= context= report= max_days_since_inactivity= register_component= description = \ The generating command is used to purge inactive entities in the Splunk Workload component \ Syntax: \ | trackmesplkwlkinactiveinspector tenant_id= context= report= max_days_since_inactivity= register_component= comment1 = \ This generating command is used to maintain splk-wlk records to be purged example1 = \ | trackmesplkwlkinactiveinspector tenant_id="mytenant" shortdesc = Python wrapper to to load and purge inactive records in Splunk Workload usage = public tags = trackme # Streaming command to extract metrics from the JSON object [trackmeextractjsonmetrics-command] syntax = | trackmeextractjsonmetrics fields= description = \ The streaming command extract all metrics from a JSON objects and add these to the output stream \ Syntax: \ | trackmeextractjsonmetrics fields= comment1 = \ This streaming command is used to extract metrics from a JSON object example1 = \ | trackmeextractjsonmetrics fields="metrics" shortdesc = Python wrapper to extract JSON metrics and add to the output stream usage = public tags = trackme # Streaming command utility for splk-dhm to extract and render the sourcetype summary JSON data [trackmeextractsplkdhm-command] syntax = | trackmeextractsplkdhm field_current= mode= tenant_id= gen_metrics= description = \ This streaming command is a command utility for splk-dhm to extract and render summary sourcetypes information \ Syntax: \ | trackmeextractsplkdhm field_current= mode= tenant_id= gen_metrics= comment1 = \ This streaming command is used by the splk-dhm component to render the sourcetype summary example1 = \ | trackmeextractsplkdhm field_current="splk_dhm_st_summary" mode="both" shortdesc = Python wrapper to extract and render sourcetype summary for splk-dhm usage = public tags = trackme # Streaming command utility for splk-mhm to extract and render the metrics summary JSON data [trackmeextractsplkmhm-command] syntax = | trackmeextractsplkmhm field_current= mode= tenant_id= gen_metrics= description = \ This streaming command is a command utility for splk-mhm to extract and render summary sourcetypes information \ Syntax: \ | trackmeextractsplkmhm field_current= mode= tenant_id= gen_metrics= comment1 = \ This streaming command is used by the splk-mhm component to render the sourcetype summary example1 = \ | trackmeextractsplkmhm field_current="metric_details" mode="both" shortdesc = Python wrapper to extract and render sourcetype summary for splk-mhm usage = public tags = trackme # Streaming command replica utility, to replicate and sync a source and target collection for replica tenants [trackmereplicator-command] syntax = | trackmereplicator component= source_tenant_id= target_tenant_id= key_field= description = \ This streaming command is a command sync utility to maintain a replica tenant_id collection for TrackMe \ Syntax: \ | trackmereplicator component= source_tenant_id= target_tenant_id= key_field= comment1 = \ This streaming command is used to maintain a replica Virtual Tenant collection for a given source and target tenant, and a given component example1 = \ | trackmereplicator component= source_tenant_id="my_source_tenant" target_tenant_id="my_target_tenant" key_field="key" shortdesc = Python wrapper to replicate and sync a KVstore collection for a replica Virtual Tenant usage = public tags = trackme # Generating command to orchestrate the execution of replica trackers [trackmereplicaexecutor-command] syntax = | trackmereplicaexecutor tenants_filter_list= max_runtime_sec= description = \ This generating custom command is used by TrackMe to orchestrate the execution of replica trackers \ Syntax: \ | trackmereplicaexecutor tenants_filter_list= max_runtime_sec= comment1 = \ This command orchestrates the execution of TrackMe replica trackers example1 = \ | trackmereplicaexecutor tenants_filter_list="*" max_runtime_sec="300" shortdesc = Python wrapper to orchestrate the execution of replica trackers usage = public tags = trackme # Streaming command utility to automatically manage logical groups [trackmeautogroup-command] syntax = | trackmeautogroup tenant_id= purge_single_member_grp= description = \ This streaming command is an utility to automatically create and manage logical groups based on a upstream list of results, \ providing the following fields: object_group_name (name of the group), object_group_members (multi-value field listing the members of the group) Syntax: \ | trackmeautogroup tenant_id= purge_single_member_grp= comment1 = \ This streaming command is a utility to create and manage logical groups based on a upstream logic example1 = \ | trackmeautogroup component= source_tenant_id="my_source_tenant" target_tenant_id="my_target_tenant" key_field="key" shortdesc = Python wrapper to automatically manage auto grouping of entities in logical groups usage = public tags = trackme # Runs a TrackMe report for the purposes of executing TrackMe trackers by admin as the system user rather than the requester [trackmeoneshotexecutor-command] syntax = | trackmeoneshotexecutor tenant_id= report= earliest= latest= use_savedsearch_time= description = \ This command is designed to run a TrackMe tracker in a oneshot manner as the system user, it requires the trackmepoweroperations capability \ Syntax: \ | trackmeoneshotexecutor tenant_id= report= earliest= latest= use_savedsearch_time= comment1 = \ This examples runs a TrackMe tracker example1 = \ | trackmeoneshotexecutor tenant_id="mytenant" report="my_tracker" earliest="-5m" latest="now" shortdesc = Runs a TrackMe report for the purposes of executing TrackMe trackers by admin as the system user rather than the requester usage = public tags = trackme # Generating command listing Flex Object use cases [trackmesplkflxgetuc-command] syntax = | trackmesplkflxgetuc description = \ This generating command lists use cases available from the Flex Objects library, \ Syntax: \ | trackmesplkflxgetuc comment1 = \ This generating command lists use cases from the Flex Objects library example1 = \ | trackmesplkflxgetuc component= source_tenant_id="my_source_tenant" target_tenant_id="my_target_tenant" key_field="key" shortdesc = List use cases from the Flex Objects library usage = public tags = trackme # Generating command to manage splk-flx inactive entities [trackmesplkflxinactiveinspector-command] syntax = | trackmesplkflxinactiveinspector tenant_id= context= report= max_days_since_inactivity_before_purge= register_component= description = \ The generating command is used to manage and purge inactive entities in the Splunk Flex Object component \ Syntax: \ | trackmesplkflxinactiveinspector tenant_id= context= report= max_days_since_inactivity_before_purge= register_component= comment1 = \ This generating command is used to maintain inactive splk-flx records example1 = \ | trackmesplkflxinactiveinspector tenant_id="mytenant" shortdesc = Python wrapper to manage inactive entities in the Flex Object component usage = public tags = trackme # Generating command to manage splk-fqm inactive entities [trackmesplkfqminactiveinspector-command] syntax = | trackmesplkfqminactiveinspector tenant_id= context= report= max_days_since_inactivity_before_purge= register_component= description = \ The generating command is used to manage and purge inactive entities in the Splunk Fields Quality component \ Syntax: \ | trackmesplkfqminactiveinspector tenant_id= context= report= max_days_since_inactivity_before_purge= register_component= comment1 = \ This generating command is used to maintain inactive splk-fqm records example1 = \ | trackmesplkfqminactiveinspector tenant_id="mytenant" shortdesc = Python wrapper to manage inactive entities in the Fields Quality component usage = public tags = trackme # Generating command for splk-soar integration purposes [trackmesplksoar-command] syntax = | trackmesplksoar soar_server= action= action_data= action_params= description = \ The generating command is used is used to interract with Splunk SOAR \ Syntax: \ - soar_server: the name of the SOAR server as configured in the Splunk App for SOAR, \ - action: an action in the following support list: soar_get|soar_post|soar_test_apps|soar_health_status|soar_health_memory|soar_health_load|soar_automation_broker_manage, \ - action_data: a JSON formated object, either used by specific actions or used to perform a POST query to a SOAR endpoint \ - action_params: a JSON formated object, used to pass additional parameters to the action \ | trackmesplksoar soar_server= action= action_data= comment1 = \ This generating command is used to interract with Splunk SOAR example1 = \ | trackmesplksoar soar_server=lab action=soar_get action_data="{\"endpoint\": \"health\"}" shortdesc = Generating command for TrackMe's Splunk SOAR integration usage = public tags = trackme # Streaming command for splk-soar integration purposes [trackmesplksoarlookup-command] syntax = | trackmesplksoarlookup soar_server= endpoint_target= source_field= dest_field_name= dest_field_definition= definition_filter_fields= description = \ This streaming command can be used to interact with the SOAR API in a lookup way, so that from an id of an object, its definition can be retrieved easily in native SPL \ Syntax: \ - soar_server: the name of the SOAR server as configured in the Splunk App for SOAR, \ - endpoint_target: the endpoint target for the object to lookup\ - source_field: the name of the field containing the object id, \ - dest_field_name: the name of the field to store the logical name of the corresponding object retrieved from this id (if any!), \ - dest_field_definition: the name of the field to store the definition of the corresponding object retrieved from this id (if any!) \ - definition_filter_fields: a comma separated list of fields to retrieve from the definition \ | trackmesplksoarlookup soar_server= endpoint_target= source_field= dest_field_name= dest_field_definition= definition_filter_fields= comment1 = \ Lookup the definition of a SOAR object from its id in a streaming manner example1 = \ | makeresults | eval asset=1 | trackmesplksoarlookup soar_server=* endpoint_target=asset source_field=asset dest_field_name=asset_name dest_field_definition=asset_definition definition_filter_fields="name,description" shortdesc = Streaming command for TrackMe's Splunk SOAR integration usage = public tags = trackme # CMDB lookup integrator [trackmesplkcmdb-command] syntax = | trackmesplkcmdb tenant_id= component= object= object_id= description = \ This command is used for the purposes of querying a CMDB to retrieve information for a given TrackMe entity \ Syntax: \ | trackmesplkcmdb tenant_id= component= object= object_id= comment1 = \ This example retrieves a given entity information from your CMDB example1 = \ | trackmesplkcmdb component="dsm" tenant_id="mytenant" object="network:pan:traffic" shortdesc = Query your CMDB from TrackMe usage = public tags = trackme # Stateful alert pre-filtering command [trackmestateful-command] syntax = | trackmestateful tenant_id= description = \ This generating command performs pre-filtering for stateful alerts by executing a simplified stateful alert search and applying filtering logic to ensure only valid events are yielded. \ The command filters events based on monitored_state, maintenance mode, ack status, object_state validation, and stateful record timing constraints. \ Syntax: \ | trackmestateful tenant_id= comment1 = \ This example pre-filters stateful alert events for a tenant, ensuring only events that should be processed are yielded example1 = \ | trackmestateful tenant_id="mytenant" shortdesc = Pre-filter stateful alert events to ensure state changes are never missed usage = public tags = trackme # Streaming command to expand the ML model outliers [trackmesplkoutliersexpand-command] syntax = | trackmesplkoutliersexpand description = \ This command retrieves and expands the ML Outliers models data \ Syntax: \ | inputlookup trackme_flx_outliers_entity_data_tenant_mytenant | trackmesplkoutliersexpand comment1 = \ This command retrieves and expands the ML Outliers models data example1 = \ | inputlookup trackme_flx_outliers_entity_data_tenant_mytenant | trackmesplkoutliersexpand shortdesc = Streaming command to expand the ML Outliers models data usage = public tags = trackme # Streaming command to expand the Flex Object extra_attributes [trackmesplkflxexpandextra-command] syntax = | trackmesplkflxexpandextra target= description = \ This command retrieves and expands the extra_attributes field for Flex Objects \ Syntax: \ | inputlookup trackme_flx_outliers_entity_data_tenant_mytenant | trackmesplkflxexpandextra comment1 = \ This command retrieves and expands the extra_attributes field for Flex Objects example1 = \ | inputlookup trackme_flx_outliers_entity_data_tenant_mytenant | trackmesplkflxexpandextra shortdesc = Streaming command to expand the extra_attributes field for Flex Objects usage = public tags = trackme # Streaming command to extract and define the dcount to be used for splk-dsm [trackmesplksetcurrentdcounthost-command] syntax = | trackmesplksetcurrentdcounthost description = \ This command defines the dcount host treshold for splk-dsm \ Syntax: \ | trackmesplksetcurrentdcounthost comment1 = \ This command defines the dcount host treshold for splk-dsm example1 = \ | inputlookup trackme_dsm_tenant_mytenant | trackmesplksetcurrentdcounthost shortdesc = Retrieve and define the dcount host threshold for splk-dsm usage = public tags = trackme # Generating command for adaptive delay inspector [trackmesplkadaptivedelay-command] syntax = | trackmesplkadaptivedelay tenant_id= component= min_delay_sec= min_historical_metrics_days= earliest_time_mstats= max_runtime= max_auto_delay_sec= max_changes_past_7days= review_period_no_days= max_sla_percentage= description = \ This command inspects delayed entities for splk-feeds components and define an adaptive threshold delay value \ Syntax: \ | trackmesplkadaptivedelay tenant_id= component= min_delay_sec= min_historical_metrics_days= earliest_time_mstats= max_runtime= max_auto_delay_sec= max_changes_past_7days= review_period_no_days= max_sla_percentage= comment1 = \ This command inspects delayed entities and define adaptive delay threshold example1 = \ | trackmesplkadaptivedelay tenant_id=01-feeds component=dsm shortdesc = Generating command to inspect delayed entities and define adaptive delay threshold usage = public tags = trackme # Generating command used to generate the search string filter for maintenance knowledge database in SLA calculations [trackmereturnmaintenancedb-command] syntax = | trackmereturnmaintenancedb tenant_id= description = \ This command generates the search string where filter for the maontenance knowledge database in SLA calculations \ Syntax: \ | trackmereturnmaintenancedb tenant_id= comment1 = \ This command returns the search string where filter for the maintenance knowledge database in SLA calculations example1 = \ | trackmereturnmaintenancedb tenant_id="mytenant" shortdesc = Returns the search string where filter for the maintenance knowledge database in SLA calculations usage = public tags = trackme # TrackMe decision maker backend [trackmedecisionmaker-command] syntax = | trackmedecisionmaker tenant_id= component= description = \ This streaming command is TrackMe's decision maker backend, which is used to defines entities status. \ Syntax: \ | trackmedecisionmaker comment1 = \ TrackMe decision maker defines the status of entities depending on the components and their context example1 = \ | trackmedecisionmaker shortdesc = TrackMe decision maker defines the status of entities depending on the components and their context usage = public tags = trackme # TrackMe splk-dsm tags tracker [trackmesplktags-command] syntax = | trackmesplktags tenant_id= component= description = \ This generating command applies the tags policies for splk-dsm, it acts as an SPL wrapper to the TrackMe REST API endpoint. \ Syntax: \ | trackmesplktags tenant_id= component= comment1 = \ TrackMe tags tracker for splk-dsm example1 = \ | trackmesplktags tenant_id="mytenant" component="dsm" shortdesc = TrackMe tags tracker for splk-dsm usage = public tags = trackme # TrackMe priority tracker [trackmesplkpriority-command] syntax = | trackmesplkpriority tenant_id= component= description = \ This generating command applies the priority policies, it acts as an SPL wrapper to the TrackMe REST API endpoint. \ Syntax: \ | trackmesplkpriority tenant_id= component= comment1 = \ TrackMe priority tracker example1 = \ | trackmesplkpriority tenant_id="mytenant" component="dsm" shortdesc = TrackMe priority tracker usage = public tags = trackme # TrackMe General Health Manager [trackmegeneralhealthmanager-command] syntax = | trackmegeneralhealthmanager description = \ This command executes TrackMe general health manager tasks \ Syntax: \ | trackmegeneralhealthmanager comment1 = \ This command executes TrackMe general health manager tasks example1 = \ | trackmegeneralhealthmanager shortdesc = TrackMe General Health Manager usage = public tags = trackme # TrackMe get component data with pagination for high scaling [trackmegetcoll-command] syntax = | trackmegetcoll tenant_id= component= mode= mode_view= filter_key= filter_object= description = \ This generating command retrieves records from a TrackMe KVstore collection with pagination and filtering capabilities for fast queries. \ Syntax: \ | trackmegetcoll tenant_id= component= mode= mode_view= filter_key= filter_object= comment1 = \ TrackMe get component data with pagination for high scaling example1 = \ | trackmegetcoll tenant_id="mytenant" component="flx" shortdesc = TrackMe get component data with pagination for high scaling usage = public tags = trackme # TrackMe perf get coll for testing purposes [trackmegetlogicalgroups-command] syntax = | trackmegetlogicalgroups tenant_id= description = \ This generating command retrieves retrieves the logical groups for verification purposes \ Syntax: \ | trackmegetlogicalgroups tenant_id= comment1 = \ TrackMe get logical groups example1 = \ | trackmegetlogicalgroups tenant_id="mytenant" shortdesc = Get logical groups usage = public tags = trackme # SLA class tracker wrapper [trackmesplkslaclass-command] syntax = | trackmesplkslaclass tenant_id= component= description = \ This generating command is used by the SLA tracker for the purposes of maintaining the SLA policies features.\ Syntax: \ | trackmesplkslaclass tenant_id=the tenant identifier> component= comment1 = \ Example of a tracker example1 = \ | trackmesplkslaclass tenant_id="mytenant" component="dsm" shortdesc = Maintains SLA policies # Streaming command to calculate the object keyid [trackmehashobject-command] syntax = | trackmehashobject input_field="" output_field= description = \ This command is used to calculate the sha256 keyid derivated from object, taking in charge non unicode characters \ Syntax: \ | trackmehashobject input_field="" output_field= comment1 = \ This command is used to calculate the sha256 keyid derivated from object, taking in charge non unicode characters example1 = \ | makeresults | eval object="myobject" | trackmehashobject input_field="object" output_field="object_keyid" shortdesc = This command is used to calculate the sha256 keyid derivated from object, taking in charge non unicode characters usage = public tags = trackme # trackmemergesplkdhm - streaming [trackmemergesplkdhm-command] syntax = | trackmemergesplkdhm field_host= field_current= field_previous= field_output= description = \ This stream custom command is used by splk-dhm to merge current and previous knowledge on a per entity basis. \ Syntax: \ | trackmemergesplkdhm field_host= field_current= field_previous= field_output= comment1 = \ This stream custom command is used by splk-dhm to merge current and previous knowledge on a per entity basis. example1 = \ | trackmemergesplkdhm field_host="host" field_current="current_summary" field_previous="previous_summary" shortdesc = This stream custom command is used by splk-dhm to merge current and previous knowledge on a per entity basis. usage = public tags = trackme # trackmemergesplkmhm - streaming [trackmemergesplkmhm-command] syntax = | trackmemergesplkmhm field_host= field_current= field_previous= field_output= description = \ This stream custom command is used by splk-mhm to merge current and previous knowledge on a per entity basis. \ Syntax: \ | trackmemergesplkmhm field_host= field_current= field_previous= field_output= comment1 = \ This stream custom command is used by splk-mhm to merge current and previous knowledge on a per entity basis. example1 = \ | trackmemergesplkmhm field_host="host" field_current="current_summary" field_previous="previous_summary" shortdesc = This stream custom command is used by splk-mhm to merge current and previous knowledge on a per entity basis. usage = public tags = trackme [trackmegetkos-command] syntax = | trackmegetkos tenant_id= description = \ This command is a simple generating command to retrieve the list of knowledge objects for a given tenant \ Syntax: \ | trackmegetkos tenant_id= comment1 = \ This example retrieves all knowledge objects for a given tenant example1 = \ | trackmegetconf tenant_id=mytenant shortdesc = Retrieve TrackMe Virtual Tenants knowledge objects usage = public tags = trackme [trackmecheckbackups-command] syntax = | trackmecheckbackups archives_list="" description = \ This command can be used to iterate through TrackMe backup archives, check and extract detailed information including knowledge objects \ Syntax: \ | trackmecheckbackups archives_list="" comment1 = \ This example checks all backups archives available on the server example1 = \ | trackmecheckbackups archives_list="trackme-backup-20241120-223310.tgz,trackme-backup-20241119-232503.tgz" shortdesc = Check and extract detailed information from TrackMe backup archives usage = public tags = trackme # TrackMe Splunk Feeds Delayed Inspector command [trackmesplkfeedsdelayedinspector-command] syntax = | trackmesplkfeedsdelayedinspector tenant_id= component= max_runtime= object_name= description = \ This command is designed to execute the delayed entities inspector for Splunk feeds \ Syntax: \ | trackmesplkfeedsdelayedinspector tenant_id= component= max_runtime= object_name= comment1 = \ This example executes the delayed entities inspector for a specific tenant and component example1 = \ | trackmesplkfeedsdelayedinspector tenant_id="mytenant" component="splk-dsm" max_runtime=300 object_name="test_feed" shortdesc = Execute the delayed entities inspector for Splunk feeds usage = public tags = trackme # A generating command to test remote accounts [trackmetestremoteaccounts-command] syntax = | trackmetestremoteaccounts accounts= description = \ This generating command is used to test remote accounts \ Syntax: \ | trackmetestremoteaccounts accounts= comment1 = \ This example tests the remote accounts example1 = \ | trackmetestremoteaccounts accounts="myaccount,myotheraccount" shortdesc = Test remote accounts usage = public tags = trackme # TrackMe Fields Quality command [trackmefieldsquality-command] syntax = | trackmefieldsquality fields_to_check_list= fields_to_check_fieldname= fields_to_check_dict= fields_to_check_dict_path= fields_to_check_dict_fieldname= fields_to_check_search_command= include_field_values= pretty_print_json= output_mode= summary_fieldname= metadata_fieldname= metadata_fields= description = \ This command checks the quality of fields in records based on specified criteria. It can validate fields against a list, a fieldname, a JSON dictionary, or a JSON file. Optionally, it can include field values in the output and pretty print the JSON summary. The 'output_mode' option allows specifying the format of the output, either 'json' or 'raw'. The 'summary_fieldname' option defines the name of the summary field, and the 'metadata_fieldname' option defines the name of the metadata field added to the summary JSON. The 'metadata_fields' option allows specifying additional metadata fields to include in the JSON summary. The 'time_mode' option specifies the time generation mode, with valid options being 'event' or 'now'.\ Syntax: \ | trackmefieldsquality fields_to_check_list= fields_to_check_fieldname= fields_to_check_dict= fields_to_check_dict_path= fields_to_check_dict_fieldname= fields_to_check_search_command= include_field_values= pretty_print_json= output_mode= summary_fieldname= metadata_fieldname= metadata_fields= comment1 = \ This example checks fields quality, specifies the output mode as 'json', uses custom field names for summary and metadata, includes additional metadata fields, and sets the time mode to 'event'. example1 = \ | trackmefieldsquality fields_to_check_list="field1,field2" output_mode="json" summary_fieldname="custom_summary" metadata_fieldname="custom_metadata" metadata_fields="field1,field2" time_mode="event" shortdesc = Check the quality of fields in records, specify output mode, customize field names, include additional metadata fields, and set time mode usage = public tags = trackme # Streaming command to extract results from trackmefieldsquality [trackmefieldsqualityextract-command] syntax = | trackmefieldsqualityextract input_field= metadata_fieldname= description = \ This command extracts results from trackmefieldsquality and creates a new record for each field. \ Syntax: \ | trackmefieldsqualityextract input_field= metadata_fieldname= comment1 = \ This example extracts results from trackmefieldsquality and creates a new record for each field. example1 = \ | trackmefieldsqualityextract input_field="_raw" metadata_fieldname="metadata" shortdesc = Extract results from trackmefieldsquality and create a new record for each field usage = public tags = trackme # Streaming command to generate summary of trackmefieldsquality [trackmefieldsqualitygensummary-command] syntax = | trackmefieldsqualitygensummary maxvals= fieldvalues_format= groupby_metadata_fields= description = \ This command generates a summary of the quality of fields in records. \ Syntax: \ | trackmefieldsqualitygensummary maxvals= fieldvalues_format= groupby_metadata_fields= comment1 = \ This example generates a summary of the quality of fields in records. example1 = \ | trackmefieldsqualitygensummary maxvals=15 fieldvalues_format=csv groupby_metadata_fields="metadata.datamodel,metadata.nodename,metadata.index,metadata.sourcetype" shortdesc = Generate summary of the quality of fields in records usage = public tags = trackme # Generating command to generate the dictionary of fields to check for CIM compliance [trackmefieldsqualitygendict-command] syntax = | trackmefieldsqualitygendict datamodel= show_only_recommended_fields= allow_unknown= allow_empty_or_missing= description = \ This command generates the dictionary of fields to check for CIM compliance. \ Syntax: \ | trackmefieldsqualitygendict datamodel= show_only_recommended_fields= allow_unknown= allow_empty_or_missing= comment1 = \ This example generates the dictionary of fields to check for CIM compliance. example1 = \ | trackmefieldsqualitygendict datamodel="Authentication" show_only_recommended_fields=true shortdesc = Generate the dictionary of fields to check for CIM compliance usage = public tags = trackme # Streaming command to push undiscovered entities to splk-dsm [trackmepushdatasource-command] syntax = trackmepushdatasource tenant_id= search_type=(tstats|raw) [show_search_query=] [show_search_results=] [pretend_latest=] show_search_results= show_search_query= pretend_latest= component= shortdesc = Pushes data source information to TrackMe splk-dsm collection. description = Processes incoming records containing object, index, and sourcetype fields. Checks if objects exist in the KV store collection and adds missing ones. \ The command requires a tenant_id and search_type (tstats or raw) to be specified. Optional parameters allow controlling the output format and time settings. example1 = | inputlookup ds_expected.csv | eval object = index . ":" . sourcetype | trackmepushdatasource component=dsm search_type=tstats tenant_id=mytenant show_search_query=True show_search_results=True pretend_latest="-24h" example2 = | inputlookup ds_expected.csv | eval object = index . ":" . sourcetype | trackmepushdatasource component=dsm search_type=tstats tenant_id=mytenant show_search_query=True show_search_results=True pretend_latest="-24h" usage = public tags = trackme # Streaming command to expand tokens in a streaming fashion [trackmeexpandtokens-command] syntax = | trackmeexpandtokens description = \ This command expands tokens in a streaming fashion. \ Syntax: \ | trackmeexpandtokens comment1 = \ This example expands tokens in a streaming fashion. example1 = | makeresults | eval user="foo", count="10" | eval result="user $user$ has done $count$ attempts" | trackmeexpandtokens shortdesc = Expand tokens in a streaming fashion usage = public tags = trackme # TrackMe Splunk Feeds Fields Quality command [trackmesplkfqmparse-command] syntax = | trackmesplkfqmparse tenant_id= context= object_metadata_list= default_threshold_fields= default_threshold_global= max_sec_inactive= tracker_name= tracker_index= description = \ This command is used to parse the fields quality of a Splunk feed. \ Syntax: \ | trackmesplkfqmparse tenant_id= context= object_metadata_list= default_threshold_fields= default_threshold_global= max_sec_inactive= tracker_name= tracker_index= comment1 = \ This example parses the fields quality of a Splunk feed. example1 = | trackmesplkfqmparse tenant_id="mytenant" context="live" group_name_field="group_name" sub_group_name_field="sub_group_name" object_metadata_list="metadata.datamodel,metadata.nodename,metadata.index,metadata.sourcetype" default_threshold_fields=99 default_threshold_global=100 max_sec_inactive=604800 tracker_name="mytracker" tracker_index=summary shortdesc = Parse the fields quality of a Splunk feed usage = public tags = trackme # trackmeyamlpath, a streaming custom command to parse YAML in a streaming fashion [trackmeyamlpath-command] syntax = | trackmeyamlpath yaml_fieldname= description = \ This command parses YAML in a streaming fashion. \ Syntax: \ | trackmeyamlpath yaml_fieldname= comment1 = \ This example parses YAML in a streaming fashion. example1 = | trackmeyamlpath yaml_fieldname="yaml_data" shortdesc = Parse YAML in a streaming fashion usage = public tags = trackme