topic Re: Armis alerts logs parsing issue in Getting Data In

Why are Armis alerts logs not parsing correctly?

smith_ — Mon, 28 Aug 2023 18:17:55 GMT

hi,

The Armis alerts in Splunk Cloud appear to be not being parsed correctly. We do have a technology addon for armis installed, how we can troubleshoot ??

Re: Armis alerts logs parsing issue

richgalloway — Thu, 17 Aug 2023 13:09:35 GMT

Sometimes one can tell by examining the events what changes need to be made. In that case, go to Settings->Source types, select the appropriate sourcetype, and made the needed changes.

Other times it's not so easy. One approach is to export some problematic events (raw) to a file. Get them from the original source, if possible. Then use the Add Data wizard to upload the file and experiment with props settings until you find the combination that works. You then can update the app as above or put the settings into an app and upload it.

Re: Armis alerts logs parsing issue

smith_ — Mon, 28 Aug 2023 17:01:02 GMT

Re: Armis alerts logs parsing issue

richgalloway — Mon, 28 Aug 2023 16:41:01 GMT

The packet field appears to encoded or encrypted. You would have to get with the vendor to determine how to make the field legible , if it can be done at all. It's possible this is data straight off the wire and that you would need the SSL certificate to process the data - not something one can do in SPL.