Authors:

“Henri van den Bulk, MS, CS, is a Technology Evangelist and Enterprise Architect at Denver Water, where he’s responsible for working with numerous stakeholders and application Scrum teams to evolve IT’s Enterprise Technology and Architecture.  Additionally he’s responsible for Leading their Enterprise Integration Service Team, where he’s optimizing business processes through integration and exposing business and operational data assets for analytics.

Prior to Denver Water he served as President/Enterprise Architect of Actie Consulting where he worked with national and international clients such as NASA, in a broad ranges of verticals.”

“Tony Nesavich currently works for Denver Water.  Tony earned his B.S. in Business Management from the University of Puget Sound (1999) and his M.S. in IT Management from Regis University (2004).  Tony has a long and proven track record of solving business and IT problems with MS PowerShell.”

Article:

We’ve found that using scripted inputs helps us to capture specific sources in Windows through the use of PowerShell. Powershell can introduce security complications when execution on machines is not managed. To enhance this security we tend to choose a script execution policy that requires the scripts to be signed.

This article describes how to leverage a more aggressive and secure execution policy setting called AllSigned. Scripts provided by Splunk and others don’t support this policy out of the box, we’ll highlight here what you can do as an organization to address this. Additionally, when developing custom inputs as a developer you’ll have to take this policy into account.

The recipe presented in this article walks through the steps necessary to use PowerShell scripts, as scripted inputs for Splunk, and use the AllSigned execution policy.

In order to use the AllSigned Execution Policy all scripts must be signed with a certificate in the Trusted Publishers.  Common issues that can result if scripts are improperly signed (or not signed at all) are the dreaded ‘AuthorizationManager check failed.‘ message in the powershell.log and many other headaches.

At a high level, regardless of your environment, the essence of the process involves the following elements.

• Certificates
  • Create and distribute the necessary certificates to the Trusted Publishers for the computer account.  They will be needed / used for validating scripts signed by them on any system running them.
• Scripted Inputs
  • Sign & deploy PowerShell scripted inputs
• Splunk Addon for Microsoft PowerShell
  • Sign & deploy the LocalStorage.psm1 script as along with the rest of the Splunk Addon for Microsoft PowerShell to the systems that will run them.

The detailed step-by-step portion in the following sections are intended to serve as an example of the concepts bulleted above.

Certificates

This only needs to be done once (and renewed when expired) and consists of the steps below.

Open Certificate Manager

• Start –> Type “MMC” –> Enter –> File, Add/Remove Snap-in… –> Certificate –> Add

• Navigate to Certificates –> Current User –> Personal –> Certificates

• Create Certificate
  • Right-click an blank area in the right hand column and choose All Tasks –> Request New Certificate…

• Click Next on the “Before You Begin” Welcome window, –> Accept the defaults (Active Directory Enrollment Policy) and click Next –> Select “PowerShell Code Signing Template 5 Years” and click Enroll

Export & Deploy Certificate

Export certificate as Base64-encoded x509 (.cer) format.
Ref:
http://technet.microsoft.com/en-us/library/cc779668(v=ws.10).aspx
http://msdn.microsoft.com/en-us/library/bb886972(v=bts.10).aspx
http://technet.microsoft.com/en-us/library/cc770735.aspx

Deploy certificate to the Trusted Publishers on the system(s) that will be running them via group policy and or manually

GPO Deployment
Configure GPO to set Execution Policy to AllSigned at the MachinePolicy Scope level on all Laptops, Desktops and Servers expected to run PowerShell Scripts.
http://technet.microsoft.com/en-us/library/cc770315%28v=ws.10%29.aspx

Manually:

Copy the certificate to each system that needs it and change directories to where you copied the cert in the PowerShell ISE or Shell and run the following command:

certmgr.exe -add <certname>.cer -c -s -r localMachine TrustedPublisher

Ref:
http://msdn.microsoft.com/en-us/library/ms172241.aspx

Sign your Scripts

After completing the steps above you will now be able to use the resulting certificate to sign your PS scripts with.  Your new cert should look like the one below (only with your name).  The steps involved in signing your scripts are outlined below.

Open PowerShell ISE & Sign your Scripts

• Start –> Type “Windows PowerShell ISE” –> Enter –> In the white Script Pane on the top part of the console paste the following:

$cert = @(gci Cert:\CurrentUser\My -CodeSigningCert)[0]
Set-AuthenticodeSignature "*.ps1" $cert -TimestampServer "http://timestamp.comodoca.com/authenticode"

• In the blue console section change directories to where your scripts are then run the script above to sign the script(s) in the present working directory of the console.
• The -TimestampServer option is important because it will allow scripts that have been signed with trusted certificates to run after the cert expires if they were signed before the certificate expired.
• If you receive an error like the one below you will have to type in the information in the code box above:
  • Set-AuthenticodeSignature : Cannot bind parameter ‘Certificate’. Cannot convert value “[Subject]

Scripted Inputs

Scripted inputs are essentially inputs that directly ingest data into Splunk and/or create output that gets ingested into Splunk.  The “netsh” example below is the later but there is a lot of pre-existing documentation on this subject and readers are encouraged to also read the following:
http://docs.splunk.com/Documentation/Splunk/6.2.0/AdvancedDev/ScriptedInputsIntro
http://docs.splunk.com/Documentation/Splunk/6.2.0/AdvancedDev/ScriptSetup

Netsh Inputs

The NetSH example application is developed to capture information about Mobile Broadband Modems that are available in Windows Laptops. This data is useful to understand the versions and communication information. For example, the information provided can allow for identifying communication issues due to roaming or signal strength issues.

This application uses scripted inputs to generate different log files that are then ingested into Splunk. The log files are created by executing the Windows NetSh command through Powershell. This is purely for instructional purposes only as we could have solved this issue in a number of different approaches. The code is available on our BitBucket site.

The following scripts run at different schedules as controlled by the inputs.conf in /%SplunkHome%/Etc/Apps/<Application>/bin.  The contents of these scripts are listed below:

• Capability.ps1 – Provides the basic information about the capabilities of the Mobile Broadband Modem

# Capability.ps1 --> Run once Daily
netsh mbn show capability interface='Mobile Broadband Connection' > "C:\Windows\Temp\Logs\capability_interface.txt"

Example Output:

Device capability information for interface Mobile Broadband Connection: 
-------------------------------------------------------
    Device type                  : Mobile Broadband device is embedded in the system
    Cellular class               : CDMA
    Voice class                  : No voice
    Sim class                    : SIM is logical or embedded in the device
    Data class                   : 1xRTT, 1xEVDO, 1xEVDO REVA
    CDMA band class              : 800 MHz, 1900 MHz
    SMS capability               : PDU receive, PDU send
    Control capability           : Hardware radio switch functionality available
                                   Configured for mobile IP with simple IP as fallback

• ConnectionRadio.ps1 – Provides Connection information for the radio

# ConnectionRadio.ps1 --> Run every 5 minutes
netsh mbn show connection interface='Mobile Broadband Connection' > "C:\Windows\Temp\Logs\connection_interface.txt"
netsh mbn show radio interface='Mobile Broadband Connection' > "C:\Windows\Temp\Logs\radio_interface.txt"

Example Output:

Connection information for interface Mobile Broadband Connection: 
-------------------------------------
    Interface State       : Connected
    Register State        : Home
    Register Mode         : Automatic
    Provider Name         : Verizon Wireless
    Provider Id           : 00000
    Provider Data Class   : 1xEVDO REVA
    Number of connections : 1
      Serial number #1
        Connection Id         : 11
        Access Point Name     :

• Interfaces.ps1

# Interfaces.ps1 --> Run every hour
netsh mbn show interfaces > "C:\Windows\Temp\Logs\interfaces.txt"

Example Output:

There is 1 interface on the system: 
    Name               : Mobile Broadband Connection
    Description        : Qualcomm Gobi 2000 HS-USB Mobile Broadband Device 250F
    GUID               : {90EDEA92-ECD6-46CF-8B53-151A77D40DC2}
    Physical Address   : xx:xx:xx:xx:xx:xx
    State              : Connected
    Device type        : Mobile Broadband device is embedded in the system
    Cellular class     : CDMA
    Device Id          : xxxxxxxxxxxxx
    Manufacturer       : Qualcomm Incorporated
    Model              : Qualcomm Gobi 2000
    Firmware Version   : 09010091
    Provider Name      : Verizon Wireless
    Roaming            : Not roaming
    Signal             : 77%

• ReadyinfoSignal.ps1

# ReadyinfoSignal.ps1 --> Run every 15 minutes
netsh mbn show readyinfo interface='Mobile Broadband Connection' > "C:\Windows\Temp\Logs\readyinfo_interface.txt"
netsh mbn show signal interface='Mobile Broadband Connection' > "C:\Windows\Temp\Logs\signal_interface.txt"

Example Output:

Ready information for interface Mobile Broadband Connection: 
------------------------------------- 
State : Ready to power up and register 
Emergency mode : Off 
Subscriber Id : xxxxxxx 
SIM ICC Id : xxxxxxx 
Number of telephone numbers : 
1 Telephone #1 : 1720xxxxxx

We then define the scripted inputs and the file monitors.

[powershell://Capability]
 script = . "$SplunkHome\etc\apps\splunk_netsh_inputs\bin\Capability.ps1"
 schedule = 0 * */23 ? * * 
 disabled = false

[monitor://C:\Windows\Temp\Logs\interfaces.txt]
 sourcetype=netsh_interfaces
 index= netsh
 disabled=false
 crcSalt = <SOURCE>

Splunk Add-on for Microsoft PowerShell signing

This is a Splunk Addon that works in conjunction with PowerShell scripted inputs.  Download this from “Splunk Base” here:

https://apps.splunk.com/app/1477/

After downloading this add-on it must be distributed to the systems that are going to run PowerShell scripted inputs.  A crucial step of the deployment process will be to sign the LocalStorage.psm1 found under SA-ModularInput-PowerShell\windows_x86_64\bin\Modules\LocalStorage.  The signing process for this is the same as the example above save for the file extension.