topic Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist? in All Apps and Add-ons

Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

vinchakov_a — Fri, 13 Nov 2015 05:25:18 GMT

11-13-2015 08:20:42.654 +0300 ERROR LookupOperator - The lookup table 'nessus_plugin_lookup' does not exist. It is referenced by configuration 'nessus_vuln'.
11-13-2015 08:20:42.654 +0300 WARN  LookupOperator - Failed to find static lookup file: nessus_plugin_lookup.csv

I received this error. TA - 1.0.6BETA.

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

vinchakov_a — Fri, 13 Nov 2015 06:54:34 GMT

I created empty csv and launched update_lookup.sh. It filled it. It downloaded data from nessus, I see them.
But in application empty dashboards.

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

sundareshr — Fri, 13 Nov 2015 15:29:50 GMT

check permissions?

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

vinchakov_a — Fri, 13 Nov 2015 15:33:59 GMT

all by root user

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

cschmidt_hurric — Fri, 13 Nov 2015 15:34:29 GMT

Try running an all-time search over sourcetype=nessus_vuln. Do you see any events? If the dashboards are empty, that probably means you have no indexed scan data.

Note: The user account that Splunk is using to log in to your Nessus scanner must be the same user that ran the scans.

EDIT: Sorry, I wrote index=nessus instead of sourcetype=nessus_vuln

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

vinchakov_a — Fri, 13 Nov 2015 15:39:44 GMT

Yes I see events in index=nessus.

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

cschmidt_hurric — Fri, 13 Nov 2015 15:49:17 GMT

Apologies, I meant sourcetype=nessus_vuln, not index=nessus.

Are the events in that sourcetype scan results?

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

vinchakov_a — Fri, 13 Nov 2015 17:07:00 GMT

sorry, index=nessus sourcetype=nessus_vuln same as index=nessus

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

vinchakov_a — Fri, 13 Nov 2015 17:09:55 GMT

I checked one of dashboard, and it is empty because it use "severity". If I delete severity in search string it works.

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

vinchakov_a — Mon, 16 Nov 2015 05:05:45 GMT

I see new data in index=nessus. But in app it is empty. For an example I take request:

tag=vulnerability tag=report report_id=* severity=* NOT severity=informational | chart count over dest by severity | sort -count limit=10 | rename low as Low, medium as Medium, high as High, critical as Critical

It is in reply empty
Then I modify request (del severity and add index=nessus)

index=nessus tag=vulnerability tag=report report_id=* | chart count over dest by severity | sort -count limit=10 | rename low as Low, medium as Medium, high as High, critical as Critical

I obtain data.

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

cschmidt_hurric — Mon, 16 Nov 2015 20:20:08 GMT

Is the severity field "informational" in all of your Nessus scan results? The Hurricane Labs App for Vulnerability Management doesn't display informational scan results in its dashboards.

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

vinchakov_a — Tue, 17 Nov 2015 07:54:57 GMT

they have no field "severity"

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

tp92222 — Thu, 18 Feb 2016 05:26:30 GMT

i am not getting any data for sourcetype=nessus_vuln

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

jeeames — Tue, 29 Sep 2020 09:04:19 GMT

I had this error until I created empty files for:

splunk/etc/apps/TA-nessus/lookups/nessus_plugin_lookup.csv

and

splunk/etc/apps/TA-nessus/lookups/nessus_scans.csv

by typing "touch nessus_scans.csv" and "touch nessus_plugin_lookup.csv" in the splunk/etc/apps/TA-nessus/lookups directory

Re: Hurricane Labs Add-on for Nessus: Why am I getting error "The lookup table 'nessus_plugin_lookup' does not exist?

duartet — Tue, 29 Sep 2020 20:56:01 GMT

But it shouldn't need those files, since the nessus_plugin_lookup points to nessus_plugin.csv