topic Re: Trend Micro officescan and deepsecurity sourcetype as not papulating in Malware datamodel in Splunk Enterprise Security

Trend Micro officescan and deepsecurity sourcetype as not papulating in Malware datamodel

rashid47010 — Sun, 30 Jun 2019 08:21:59 GMT

Maily I have three sourcetypes
sourcetype=Officescan ( workstation logs( signature update, malware etc)
sourcetype = deepsecurity ( servers, malware logs)
sourcetype = trendmicro ( TrendMicro Control centre logs)

I can see the sourecetype=trendmicro with tag=malware. but other I can't see although they have also tag=malware.

secondly how can I made the app CIM compliant.

Re: Trend Micro officescan and deepsecurity sourcetype as not papulating in Malware datamodel

rashid47010 — Sun, 30 Jun 2019 12:53:50 GMT

In continuation of above, I install the TA_officescan TA on search head and on ES.
on search Head I can see the proper field extration and tags assosication. whereas In ES i cant see field extration NOR tag association.
am i missing something.?

Re: Trend Micro officescan and deepsecurity sourcetype as not papulating in Malware datamodel

rashid47010 — Sun, 30 Jun 2019 14:09:06 GMT

Answering to myself:

the naming convention for splunk apps to be appear in Splunk ES.

Referrence URL: https://docs.splunk.com/Documentation/ES/4.1.0/Install/InstallTechnologyAdd-ons#Import_add-ons_with_a_different_naming_convention

Re: Trend Micro officescan and deepsecurity sourcetype as not papulating in Malware datamodel

amankhan1 — Sat, 07 Mar 2020 12:08:53 GMT

HI Rashid, which TA did you use for officescan?