Setup

To get started:

1. Open a terminal and run the following commands as the user running Splunk:

cd /opt/splunk/etc/apps
git clone https://github.com/ecstatic-nobel/OSweep.git || wget https://github.com/ecstatic-nobel/OSweep/archive/master.zip
ls OSweep || unzip -o master.zip && mv OSweep-master OSweep && mv master.zip .OSweep-master.zip
sudo -H -u $SPLUNK_USER /opt/splunk/bin/splunk restart # $SPLUNK_USER = User running Splunk

2. Edit "config.py" and add the necessary values as strings (surrounded by quotes) to the config file:

vim ./OSweep/etc/config.py

Note: Values for the proxies should be the full URL including the port (ex. http://<IP Adress>:<Port>).
3. Save "config.py" and close the terminal.
4. Install/Upgrade Pip packages:

cd /opt/splunk/etc/apps/OSweep/bin
sudo rm -rf _tp_modules/*
sudo pip install -r requirements.txt -t _tp_modules/

Go to Commands