https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449987#M6230 <P>Hi Experts,</P> <P>I am trying to setup a glasstable containing the result from cvss score field. </P> <P>I seem to get other result related to this (CVE, crticality level etc.) but the cvss field is not extracted. I can see that the field is available in the "vulnerability" datamodel.</P> <P>Thanks</P> Thu, 06 Sep 2018 08:38:59 GMT tfrandsen 2018-09-06T08:38:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449987#M6230 <P>Hi Experts,</P> <P>I am trying to setup a glasstable containing the result from cvss score field. </P> <P>I seem to get other result related to this (CVE, crticality level etc.) but the cvss field is not extracted. I can see that the field is available in the "vulnerability" datamodel.</P> <P>Thanks</P> Thu, 06 Sep 2018 08:38:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449987#M6230 tfrandsen 2018-09-06T08:38:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449988#M6231 <P>Is the CVSS score field present in your events? The datamodel can't extract what's not in the data.</P> Thu, 06 Sep 2018 11:59:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449988#M6231 richgalloway 2018-09-06T11:59:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449989#M6232 <P>With events do you mean incident review panel? the cvss score is not showed in either the incident review panel or in search results. </P> Thu, 06 Sep 2018 12:05:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449989#M6232 tfrandsen 2018-09-06T12:05:42Z https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449990#M6233 <P>The field is not present in the search result </P> Thu, 06 Sep 2018 12:06:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449990#M6233 tfrandsen 2018-09-06T12:06:19Z https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449991#M6234 <P>I can see the cvss score result in my splunk module where i have Qualys app installed. Its just in my SIEM i cant see it</P> Thu, 06 Sep 2018 12:07:33 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449991#M6234 tfrandsen 2018-09-06T12:07:33Z https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449992#M6235 <P>So the CVSS score field is present , but is not being extracted by the data model. You'll need to edit the data model to extract the field from your events.</P> Thu, 06 Sep 2018 18:35:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449992#M6235 richgalloway 2018-09-06T18:35:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449993#M6236 <P>How and what do I edit in the data model to extract the data. Have not been able to find information about this online</P> Thu, 06 Sep 2018 19:06:30 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/cvss-score-result-not-available-in-Splunk-Enterprise-Security/m-p/449993#M6236 tfrandsen 2018-09-06T19:06:30Z