topic Re: Why did Infosec App stopped showing data? in All Apps and Add-ons

Why did Infosec App stop showing data?

dminguez — Fri, 25 Mar 2022 18:55:29 GMT

Hi,

I have configured the Infosec App in my splunk making sure that i had all the steps in prerequisites completed. It was working for a couple of days, but it suddenly sttoped showing data. I have CIM for splunk and I can see in the health panel from infosec that the acceleration for the data models is working but I'm only recieving event and details from the Authentication and Change data model.

going through this documentation https://docs.splunk.com/Documentation/InfoSec/1.7.0/Admin/ValidateDataSources#Identify_tagged_events_to_configure_the_data_models

I have checked that only Authentication and Change are getting data, not the rest. If I try to follow the guide there is no tags for the rest of the datamodels.

Is this why infosec stopped working?

Can anyone help with this?

Thank you.

Regards

Re: Why did Infosec App stopped showing data?

Stefanie — Fri, 25 Mar 2022 16:11:17 GMT

@dminguez

What's the CIM version installed?

On the CIM Setup page, did you verify all the required Data Models are Accelerated?

Are the required indexes in the "Indexes whitelist" aligned with their respective Data Model?

Do you have the required TAs for your log data installed on your Search Head?

Re: Why did Infosec App stopped showing data?

dminguez — Tue, 29 Mar 2022 10:01:12 GMT

Hi @Stefanie ,

1.- The CIM version I have installed is 5.0.1.

2.- When i accelerated the models after installing, infosec was reciecing data and after a couple of days sttoped working.

3.- When I check the index whitelist of each data model it's blank, Is there anything I should add to it?

4.- I have installed all required TA's written in the infosec App prerequisites.

Another thing that seems strange is that checking the data model from Settings - Knowledge - Data models. If I choose any model and edit the constraint but without modifying it, an error shows up saying this: "In handler 'datamodeledit': Error in 'Authentication': Dataset constraints must specify at least one index. "

Thanks for your answers.

Re: Why did Infosec App stopped showing data?

Stefanie — Tue, 29 Mar 2022 12:44:31 GMT

Interesting.
I had the same problem with my CIM for Enterprise Security. The index whitelist was blank and I wasn't getting events anymore.

In the Indexes Whitelist field, can you put * ? Here's an example of mine.

Make that change and let it sit for a few minutes to run. Then try searching that datamodel using a search like

(`cim_Authentication_indexes`)

After verifying data is coming in, you can manually specify the indexes in the Indexes Whitelist by what's showing up using the wildcard.

Let me know how this works for you.

Re: Why did Infosec App stopped showing data?

dminguez — Tue, 29 Mar 2022 15:12:26 GMT

Hi @Stefanie,

I did what you said in the data models that are needed for the infosec app.

Nothing changed from the health panel view. It keeps only getting data from authentication and change although the acceleration works good for all of them except for malware and web.

One thing i saw that changed is when running the query to identify indexes that feed the data models.

Now i see that network traffic and network sessions data models are no longer indicating "NO DATA FOUND" and they show 1.708.289 and 24.981 events taking them from the main index.

Still not getting that data in infosec... I also did the query that you suggested before and everything seems to be working.

I was wondering if you could post a screenshot of your network traffic data model just to adjust the settings the same way you have them.

When I added the "*" in the data models i saw that your tag whitelist was blank and mine has 4 or 5 tags, is it supposed to be like that?

Thanks for you help.

Re: Why did Infosec App stopped showing data?

Stefanie — Tue, 29 Mar 2022 15:25:11 GMT

My settings for the Network traffic data model is the same as the screenshot above. The only difference is after I used the wildcard to include all indexes, waited to see what it detected, then I modified the settings to only include the indexes it was aligning to the data model using the search:

(`cim_Network_Traffic_indexes`)

As for your tag whitelist. I removed everything. I didn't understand why those specific tags were there when if you go to the Data Model page in Splunk and look at the Data Models, those tags did not align with the tags it wants. For example the "All Traffic" search for the Network Traffic data model is

(`cim_Network_Traffic_indexes`) tag=network tag=communicate

Those two tags weren't in the tag whitelist in the CIM settings. Try removing them too. Just make sure you have a screenshot or a backup before you do, incase you need them back.