chore(deps): update dependency zipp to v3.23.0

docs/sources/vendor/Citrix/netscaler.md

@@ -7,27 +7,33 @@
 
 ## Links
 
-| Ref            | Link                                                                                                    |
-|----------------|---------------------------------------------------------------------------------------------------------|
-| Splunk Add-on  | <https://splunkbase.splunk.com/app/2770/>                                                                 |
+| Ref            | Link                                                                                                |
+|----------------|-----------------------------------------------------------------------------------------------------|
+| Splunk Add-on  | <https://splunkbase.splunk.com/app/2770/>                                                           |
 | Product Manual | <https://docs.citrix.com/en-us/citrix-adc/12-1/system/audit-logging/configuring-audit-logging.html> |
 
 ## Sourcetypes
 
-| sourcetype     | notes                                                                                                   |
-|----------------|---------------------------------------------------------------------------------------------------------|
-| citrix:netscaler:syslog         | None                                                                                                    |
-| citrix:netscaler:appfw         | None                                                                                                    |
-| citrix:netscaler:appfw:cef     | None                                                                                                    |
+| sourcetype                 | notes |
+|----------------------------|-------|
+| citrix:netscaler:syslog    | None  |
+| citrix:netscaler:appfw     | None  |
+| citrix:netscaler:appfw:cef | None  |
 
 ## Sourcetype and Index Configuration
 
-| key            | sourcetype     | index          | notes          |
-|----------------|----------------|----------------|----------------|
-| citrix_netscaler         | citrix:netscaler:syslog         | netfw          | none           |
-| citrix_netscaler         | citrix:netscaler:appfw         | netfw          | none           |
-| citrix_netscaler         | citrix:netscaler:appfw:cef         | netfw          | none           |
+| key              | sourcetype                 | index | notes |
+|------------------|----------------------------|-------|-------|
+| citrix_netscaler | citrix:netscaler:syslog    | netfw | none  |
+| citrix_netscaler | citrix:netscaler:appfw     | netfw | none  |
+| citrix_netscaler | citrix:netscaler:appfw:cef | netfw | none  |
 
 ## Source Setup and Configuration
 
-* Follow vendor configuration steps per Product Manual above. Ensure the data format selected is "DDMMYYYY"
+* Follow vendor configuration steps per Product Manual above.
+
+## Options
+
+| Variable                                   | default      | description                                                                                   |
+|--------------------------------------------|--------------|-----------------------------------------------------------------------------------------------|
+| `SC4S_IGNORE_MMDD_LEGACY_CITRIX_NETSCALER` | empty string | (empty/yes) Set to "yes" for parsing the date in format `dd/mm/yyyy` instead of `mm/dd/yyyy`. |

docs/sources/vendor/Dell/emc_powerstore.md

@@ -0,0 +1,26 @@
+# Dell Powerstore
+
+## Key facts
+
+* MSG Format based filter
+* Legacy BSD Format default port 514
+
+## Links
+
+| Ref            | Link                                                                                                                            |
+|----------------|---------------------------------------------------------------------------------------------------------------------------------|
+| Splunk Add-on  | N/A                                                                                                                             |
+| Add-on Manual  | N/A                                                                                                                             |
+| Product Manual | [Powerstore Documentation](https://www.dell.com/support/kbdoc/en-us/000130110/powerstore-info-hub-product-documentation-videos) |
+
+## Sourcetypes
+
+| sourcetype            | notes |
+|-----------------------|-------|
+| `dell:emc:powerstore` | None  |
+
+### Index Configuration
+
+| key                | sourcetype            | index    | notes |
+|--------------------|-----------------------|----------|-------|
+| dellemc_powerstore | `dell:emc:powerstore` | `netops` | none  |

docs/sources/vendor/ISC/dhcpd.md

@@ -19,13 +19,13 @@ see that source documentation for instructions
 
 | sourcetype     | notes                                                                                                   |
 |----------------|---------------------------------------------------------------------------------------------------------|
-| isc:dhcp | none |
+| isc:dhcpd | none |
 
 ### Index Configuration
 
 | key            | index      | notes          |
 |----------------|------------|----------------|
-| isc_dhcp     | isc:dhcp          | none          |
+| isc_dhcpd     | netipam          | none          |
 
 ### Filter type
 
@@ -42,5 +42,5 @@ An active site will generate frequent events use the following search to check f
 Verify timestamp, and host values match as expected
 
 ```
-index=<asconfigured> (sourcetype=isc:dhcp")
+index=<asconfigured> (sourcetype=isc:dhcpd")
 ```

docs/upgrade.md

@@ -18,6 +18,10 @@ For a step by step guide [see here](./v3_upgrade.md).
 
 You may need to migrate legacy log paths or version 1 app-parsers for version 2. To do this, open an issue and attach the original configuration and a compressed pcap of sample data for testing. We will evaluate whether to include the source in an upcoming release.
 
+### Upgrade from <3.37.0
+In `entrypoint.sh` the old variable mappings `SPLUNK_HEC_URL`, `SPLUNK_HEC_TOKEN`, `SC4S_DEST_SPLUNK_HEC_TLS_VERIFY` are deprecated and will not be 
+further reassigned, instead use `SC4S_DEST_SPLUNK_HEC_DEFAULT_URL`, `SC4S_DEST_SPLUNK_HEC_DEFAULT_TOKEN`, `SC4S_DEST_SPLUNK_HEC_DEFAULT_TLS_VERIFY`.
+
 ### Upgrade from <3.33.0
 In NetApp ONTAP, the ontap:ems sourcetype has been updated to netapp:ontap:audit, so old logs are now classified under netapp:ontap:audit. Additionally, a new netapp:ontap:ems sourcetype has been introduced. If you upgrade and want these new changes, ensure that you set `SC4S_NETAPP_ONTAP_NEW_FORMAT` environment variable to `yes` and configure your system to send the logs to a specific port or have a hostname-based configuration in place for proper log onboarding into Splunk.
 

package/enterprise/etc/conf.d/conflib/almost-syslog/app-almost-syslog-citrix_netscaler.conf

@@ -10,7 +10,7 @@ block parser app-almost-syslog-citrix_netscaler() {
         parser {
             regexp-parser(
                 prefix(".tmp.")
-                patterns('^(?<pri>\<\d+>) (?<timestamp>(?<tspart1>\d\d)\/\d\d\/\d\d\d\d:\d\d:\d\d:\d\d ?(?<tz>\w+))? (?<host>[^ ]+) (?<message>[A-Z\-0-9]+ : .*)')
+                patterns('^(?<pri>\<\d+\>) (?<timestamp>(?<tspart1>\d\d)\/\d\d\/\d\d\d\d:\d\d:\d\d:\d\d ?(?<tz>\w+))? (?<host>[^ ]+) (?<message>[A-Z\-0-9]+ : .*)')
             );
         };
         parser {
@@ -19,11 +19,12 @@ block parser app-almost-syslog-citrix_netscaler() {
             );
         };
 
+
         if {
-            filter { "${.tmp.tspart1}" eq "$R_DAY"};
+            filter { "`SC4S_IGNORE_MMDD_LEGACY_CITRIX_NETSCALER`" eq "yes" or "${.tmp.tspart1}" eq "${DAY}"};
             parser {
                 date-parser-nofilter(
-                    format('%d/%m/%Y:%H:%M:%S %z','%d/%m/%Y:%H:%M:%S')
+                    format('%d/%m/%Y:%H:%M:%S %z','%d/%m/%Y:%H:%M:%S','%d/%m/%Y:%H:%M:%S %Z')
                     template("${.tmp.timestamp}")
                 );
             };

package/enterprise/etc/conf.d/conflib/syslog/app-syslog-dell_powerstore.conf

@@ -0,0 +1,18 @@
+block parser app-syslog-dell_powerstore() {
+ channel {
+        rewrite {
+            r_set_splunk_dest_default(
+                index('netops')
+                sourcetype('dell:emc:powerstore')
+                vendor('dellemc')
+                product('powerstore')
+            );
+        };
+    };
+};
+application app-syslog-dell_powerstore[sc4s-network-source] {
+    filter {
+        match('\[PowerStore_audit_event@1139' value("MESSAGE"));
+        };
+	parser { app-syslog-dell_powerstore(); };
+};

package/etc/conf.d/conflib/almost-syslog/app-almost-syslog-citrix_netscaler.conf

@@ -10,7 +10,7 @@ block parser app-almost-syslog-citrix_netscaler() {
         parser {
             regexp-parser(
                 prefix(".tmp.")
-                patterns('^(?<pri>\<\d+>) (?<timestamp>(?<tspart1>\d\d)\/\d\d\/\d\d\d\d:\d\d:\d\d:\d\d ?(?<tz>\w+))? (?<host>[^ ]+) (?<message>[A-Z\-0-9]+ : .*)')
+                patterns('^(?<pri>\<\d+\>) (?<timestamp>(?<tspart1>\d\d)\/\d\d\/\d\d\d\d:\d\d:\d\d:\d\d ?(?<tz>\w+))? (?<host>[^ ]+) (?<message>[A-Z\-0-9]+ : .*)')
             );
         };
         parser {
@@ -19,11 +19,12 @@ block parser app-almost-syslog-citrix_netscaler() {
             );
         };
 
+
         if {
-            filter { "${.tmp.tspart1}" eq "$R_DAY"};
+            filter { "`SC4S_IGNORE_MMDD_LEGACY_CITRIX_NETSCALER`" eq "yes" or "${.tmp.tspart1}" eq "${DAY}"};
             parser {
                 date-parser-nofilter(
-                    format('%d/%m/%Y:%H:%M:%S %z','%d/%m/%Y:%H:%M:%S')
+                    format('%d/%m/%Y:%H:%M:%S %z','%d/%m/%Y:%H:%M:%S','%d/%m/%Y:%H:%M:%S %Z')
                     template("${.tmp.timestamp}")
                 );
             };

package/etc/conf.d/conflib/syslog/app-syslog-dell_powerstore.conf

@@ -0,0 +1,18 @@
+block parser app-syslog-dell_powerstore() {
+ channel {
+        rewrite {
+            r_set_splunk_dest_default(
+                index('netops')
+                sourcetype('dell:emc:powerstore')
+                vendor('dellemc')
+                product('powerstore')
+            );
+        };
+    };
+};
+application app-syslog-dell_powerstore[sc4s-network-source] {
+    filter {
+        match('\[PowerStore_audit_event@1139' value("MESSAGE"));
+        };
+	parser { app-syslog-dell_powerstore(); };
+};

package/lite/etc/addons/citrix/app-almost-syslog-citrix_netscaler.conf

@@ -10,7 +10,7 @@ block parser app-almost-syslog-citrix_netscaler() {
         parser {
             regexp-parser(
                 prefix(".tmp.")
-                patterns('^(?<pri>\<\d+>) (?<timestamp>(?<tspart1>\d\d)\/\d\d\/\d\d\d\d:\d\d:\d\d:\d\d ?(?<tz>\w+))? (?<host>[^ ]+) (?<message>[A-Z\-0-9]+ : .*)')
+                patterns('^(?<pri>\<\d+\>) (?<timestamp>(?<tspart1>\d\d)\/\d\d\/\d\d\d\d:\d\d:\d\d:\d\d ?(?<tz>\w+))? (?<host>[^ ]+) (?<message>[A-Z\-0-9]+ : .*)')
             );
         };
         parser {
@@ -19,11 +19,12 @@ block parser app-almost-syslog-citrix_netscaler() {
             );
         };
 
+
         if {
-            filter { "${.tmp.tspart1}" eq "$R_DAY"};
+            filter { "`SC4S_IGNORE_MMDD_LEGACY_CITRIX_NETSCALER`" eq "yes" or "${.tmp.tspart1}" eq "${DAY}"};
             parser {
                 date-parser-nofilter(
-                    format('%d/%m/%Y:%H:%M:%S %z','%d/%m/%Y:%H:%M:%S')
+                    format('%d/%m/%Y:%H:%M:%S %z','%d/%m/%Y:%H:%M:%S','%d/%m/%Y:%H:%M:%S %Z')
                     template("${.tmp.timestamp}")
                 );
             };

package/lite/etc/addons/dell/app-syslog-dell_powerstore.conf

@@ -0,0 +1,18 @@
+block parser app-syslog-dell_powerstore() {
+ channel {
+        rewrite {
+            r_set_splunk_dest_default(
+                index('netops')
+                sourcetype('dell:emc:powerstore')
+                vendor('dellemc')
+                product('powerstore')
+            );
+        };
+    };
+};
+application app-syslog-dell_powerstore[sc4s-network-source] {
+    filter {
+        match('\[PowerStore_audit_event@1139' value("MESSAGE"));
+        };
+	parser { app-syslog-dell_powerstore(); };
+};