icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading TA for Digital Guardian
SHA256 checksum (ta-for-digital-guardian_204.tgz) 94b7c09ff967036b28424fdd3d4ea557117b4a698a8f6c3a375d9a66d726dd8e SHA256 checksum (ta-for-digital-guardian_203.tgz) 5eacb207f46f10a1cf281b4721d720045613a948fd39a3694e46bb4940081fc0 SHA256 checksum (ta-for-digital-guardian_130.tgz) dccdb7d4b957bd3d6cf59d1b54ef6e18a7abc62e921f8f725a441a11de31038c SHA256 checksum (ta-for-digital-guardian_112.tgz) 1f633fa3937194d427842ad9d5ff48401ea792dfe99ebce607d9263a8ca20827 SHA256 checksum (ta-for-digital-guardian_111.tgz) 8c256e2b9ca625df76b15675583b23994948229f3aaebd4c794324223869d2ed
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

splunk

TA for Digital Guardian

This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
Digital Guardian offers security’s most technologically advanced endpoint agent. Only Digital Guardian ends data theft by protecting sensitive data from skilled insiders and persistent outside attackers.

The Digital Guardian App for Splunk Enterprise lets customers understand risks to sensitive data across the enterprise from insider and outsider threats and respond appropriately. Users can improve incident response and investigation times by leveraging Splunk’s enterprise search capabilities across Digital Guardian event and alert data. This app contains the Add-on which brings Digital Guardian events and alerts into Splunk Enterprise. The Add-on is designed for Digital Guardian 7.0.0 and above. For use with previous versions please contact Digital Guardian.

Table of Contents

OVERVIEW

  • About the TA for Digital Guardian
  • Release notes
  • Support and resources

INSTALLATION AND CONFIGURATION

  • Hardware and software requirements
  • Installation steps
  • Deploy to single server instance
  • Deploy to distributed deployment
  • Deploy to distributed deployment with Search Head Pooling
  • Deploy to distributed deployment with Search Head Clustering
  • Deploy to Splunk Cloud
  • Configure TA for Digital Guardian

USER GUIDE

  • Data types
  • Lookups

OVERVIEW

About the TA for Digital Guardian

  • Author: Digital Guardian
  • App Version: 1.1.2
  • Vendor Products: Digital Guardian 6.2.2 and above
  • Has index-time operations: true, this add-on must be placed on indexers
  • Create an index: true, impacts disk storage
  • Implements summarization: false

The Digital Guardian App for Splunk Enterprise lets customers understand risks to sensitive data across the enterprise from insider and outsider threats and respond appropriately. Users can improve incident response and investigation times by leveraging Splunk’s enterprise search capabilities across Digital Guardian event and alert data. The App works with this Add-on which brings Digital Guardian events and alerts into Splunk Enterprise. This Add-on is designed for Digital Guardian 6.2.2 and above. For use with previous versions please contact Digital Guardian.

Scripts and binaries

None

Release notes

About this release

Version 1.1.2 of the TA for Digital Guardian is compatible with:

  • Splunk Enterprise versions: 6.2, 6.1
  • CIM: 4.1, 4.0, 3.0
  • Platforms: Platform independent
  • Vendor Products: Digital Guardian 6.2.2 and above
  • Lookup file changes: Added severity_lookup
New features

TA for Digital Guardian includes the following new features:

  • Update Documentation
Fixed issues

Version 1.1.2 of the TA for Digital Guardian fixes the following issues:
- Fixed Bug in props.conf

Version 1.1.1 of the TA for Digital Guardian fixes the following issues:
- Updated EventGen Samples
- Updated Documentation
- Removed hidden files

Version 1.1 of the TA for Digital Guardian fixes the following issues:

  • Fixed CIM Compliance
Support and resources

Questions and Answers
Access questions and answers about the TA for Digital Guardian at http://answers.splunk.com/answers/app/1878

Support

Support URL: https://digitalguardian.force.com/support/login
How to get support: via above support portal URL. Login is required for Digital Guardian customers; customers who do not have a support login may apply for one at support@digitalguardian.com
Support hours: 24/7
Observed holidays: Closed on major US holidays.
Response: all cases submitted will be confirmed via email; response time based on severity
Cases are tracked in the salesforce.com system

INSTALLATION AND CONFIGURATION

Hardware and software requirements

Hardware requirements

TA for Digital Guardian supports the following server platforms in the versions supported by Splunk Enterprise:

  • Linux
  • Windows
  • Solaris

Software requirements

To function properly, TA for Digital Guardian requires the following software:

  • Digital Guardian 6.2.2 and above

Splunk Enterprise system requirements

Because this add-on runs on Splunk Enterprise, all of the Splunk Enterprise system requirements apply.

Download

Download the TA for Digital Guardian at https://apps.splunk.com/app/1878/.

Installation steps

To install and configure this app on your supported platform, follow these steps:

  1. Download and Deploy the add-on to either a single Splunk Enterprise server or a distributed deployment.
  2. Configure your Digital Guardian server to export data to your single instance or your forwarder.
  3. Configure your inputs to get your Digital Guardian data into Splunk Enterprise.
Deploy to single server instance

Follow these steps to install the app in a single server instance of Splunk Enterprise:

  1. Download from Splunk Apps.
  2. In Splunk Web, click Apps > Manage Apps.
  3. Click Install app from file.
  4. Locate the downloaded file and click Upload.
  5. Verify that the add-on appears in the list of apps and add-ons. You can also find it on the server at $SPLUNK_HOME/etc/apps/TA-digitalguardian.
  6. Copy $SPLUNK_HOME/etc/apps/TA-digitalguardian/default/inputs.conf to $SPLUNK_HOME/etc/apps/TA-digitalguardian/local
  7. Edit inputs.conf to match your log locations.
  8. Restart Splunk
Deploy to distributed deployment

Install to search head

  1. Download from Splunk Apps.
  2. In Splunk Web, click Apps > Manage Apps.
  3. Click Install app from file.
  4. Locate the downloaded file and click Upload.
  5. Verify that the add-on appears in the list of apps and add-ons. You can also find it on the server at $SPLUNK_HOME/etc/apps/TA-digitalguardian.

Install to indexers

  1. Download from Splunk Apps.
  2. In Splunk Web, click Apps > Manage Apps.
  3. Click Install app from file.
  4. Locate the downloaded file and click Upload.
  5. Verify that the add-on appears in the list of apps and add-ons. You can also find it on the server at $SPLUNK_HOME/etc/apps/TA-digitalguardian.

Install to forwarders

  1. Upload the TA-digitalguardian folder to the forwarder and put into the $SPLUNK_HOME/etc/apps directory.
  2. Copy $SPLUNK_HOME/etc/apps/TA-digitalguardian/default/inputs.conf to $SPLUNK_HOME/etc/apps/TA-digitalguardian/local
  3. Edit inputs.conf to match your log locations.
  4. Restart Splunk

Configure TA for Digital Guardian

Configuration Steps are in Installation Instructions.

USER GUIDE

Digital Guardian offers security’s most technologically advanced endpoint agent. Only Digital Guardian ends data theft by protecting sensitive data from skilled insiders and persistent outside attackers.

The Digital Guardian App for Splunk Enterprise lets customers understand risks to sensitive data across the enterprise from insider and outsider threats and respond appropriately. Users can improve incident response and investigation times by leveraging Splunk’s enterprise search capabilities across Digital Guardian event and alert data. The App includes an Add-on which brings Digital Guardian events and alerts into Splunk Enterprise. The Add-on is designed for Digital Guardian 6.2.2 and above. For use with previous versions please contact Digital Guardian.

The Digital Guardian App for Splunk Enterprise includes seven dashboards that visualize Digital Guardian events and alerts with advanced abilities to drill down and filter data to pinpoint threats, investigate and respond. Dashboards include:

  • Data Classification: Show that sensitive data is effectively identified and classified
  • Alerts: Monitor policy violations, validate appropriate controls are in place and provide input into incident response process
  • Events: Monitor data leaving the enterprise by channel - Email, Print, Removable Devices and Network Uploads. Understand channel usage to establish risk level.
  • Process: Monitor process (application) access to data and identify anomalies
  • Data Egress: Monitor data movement to understand how and where data is put at risk to improve classification and controls
  • Advanced Threat Detection: Monitor malware alerts resulting from behavioral detection rules in Digital Guardian’s advanced threat module
  • Operations: Monitor operations of the Digital Guardian IT infrastructure

These data types support the following Common Information Model data models:

  • Alerts

Lookups

The TA for Digital Guardian contains 1 lookup file.

severity_lookup

Translates Severity Code to Human Readable Name.

  • File location: TA-digitalguardian/lookups/severity_lookup.csv
  • Lookup fields: key,value
  • Lookup contents:
key,value
1,Informational
2,Low
3,Medium
4,High
5,Critical

Release Notes

Version 2.0.4
March 12, 2018
Version 2.0.3
Feb. 9, 2018

2.0.3 - 2/8/2018
* Updated file permissions

Version 1.3.0
June 4, 2015

Version 1.3.0 TA for Digital Guardian includes the following new features:
- Moved Lookup Tables from App to TA (computer_type_lookup, dg_protocol_lookup, drive_type_lookup, email_recepient_type_lookup, file_encryption_lookup, network_direction_lookup, operations_lookup, rule_action_type_lookup, scanvalue_lookup)
- Added Custom Event functionality for Alerts
- Update Version Number to match digitalguardian_web

Version 1.1.2
March 27, 2015

Version 1.1.2 of the TA for Digital Guardian fixes the following issues:
- Fixed Bug in props.conf

Version 1.1.1
March 16, 2015

Version 1.1.1 of the TA for Digital Guardian fixes the following issues:
- Updated EventGen Samples
- Updated Documentation
- Removed hidden files


Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.