found x unexpected values

splunkcol — Mon, 28 Dec 2020 17:25:54 GMT

I am using the APP "SA-cim_vladiator" and this message appears indicating that it has found unexpected values

In this order of ideas it is only analyzing me and detecting the logs with the action = allowed field

And those that in the value action = Accept or suscces or pass are not detecting them

The same happens for blocked where drop or deny are not detected in the action field

How can I solve this situation?

Re: found x unexpected values

scelikok — Mon, 28 Dec 2020 21:08:28 GMT

Hi, @splunkcol,

- First you should check index constraints for Network_Traffic model. If this macro is not set, you should set indexes that has traffic data.

- Install CIM compatible TA's for network traffic sources. (With ES this applies to all sourcetypes that feeds datamodels)

- Even using CIM compatible TA's may not resolve all problems. You should map all invalid values to valid recommended ones (allowed, blocked, teardown) using FIELDALIAS, EVAL or lookups.

You can use https://docs.splunk.com/Documentation/CIM/4.18.0/User/NetworkTraffic as a reference.

If this reply helps you an upvote is appreciated.

topic Re: found x unexpected values in Splunk Enterprise Security

found x unexpected values

Re: found x unexpected values