topic Darktrace connector not showing data on dashboard in All Apps and Add-ons

Darktrace connector not showing data on dashboard

aoweneoecoop — Wed, 30 Sep 2020 03:28:15 GMT

Hi all, We have installed the darktrace app in the search engine and we have confirmed the data is being sent from darktrace on the relevant port but we have not got any data in the dashboard. the input.conf and props.conf are below but we cannot see why the data is not being populated.

local inputs.conf
[tcp://10511]
connection_host = dns
index = darktrace
sourcetype = darktrace
local props.conf
[darktrace]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
disabled = false

can someone advise why we cant see the data?

Re: Darktrace connector not showing data on dashboard

aoweneoecoop — Tue, 31 Dec 2019 11:10:34 GMT

I have managed to resolve this

Re: Darktrace connector not showing data on dashboard

richgalloway — Tue, 31 Dec 2019 13:39:31 GMT

@aoweneoecoop To help future readers, please explain how you resolved the problem.

Re: Darktrace connector not showing data on dashboard

crebollorodrigu — Thu, 20 Feb 2020 09:54:16 GMT

Hi,

I analized Darktrace dashboard queries and my current json syslog is not including fields "breachUrl" or "modbreachUrl".

In most of queries is written .... | eval darktraceUrl = coalesce(breachUrl,modbreachUrl) | dedup darktraceUrl | ... and this makes empty all queries because is deleting all logs without breachUrl and modbreachUrl

Try to add manually the flag keepempty=true to not to delete logs with these empty fields.
To make it works, all dashboard queries should add this anytime dedup appears:

| eval darktraceUrl = coalesce(breachUrl,modbreachUrl) | dedup darktraceUrl keepempty=true |