topic Splunk CMDB Lookup in Splunk Enterprise Security

Splunk CMDB Lookup

amit1791yadav — Mon, 08 Mar 2021 07:39:06 GMT

We want to override the lookup File as per the below condition.

If File not exist - we don't want to override the lookup file.
And IF File exist - We can proceed to override the lookup file .

index=siem_test sourcetype="db:cmdb"
| timechart count by source

IF CMDB part not lost don't override the output lookup and how do we can check the sourcetype is not reporting.

Please suggest any condition which we can use in our search query to populate the result.

Re: Splunk CMDB Lookup

lekanneer — Fri, 09 Apr 2021 15:00:01 GMT

This is why I developed a solution to overcome the problem of lookups and/or indexes and/or complex searches. My solution is using a Neo4j graph database in between the source of the information and Splunk. The good thing of the graph database is that it is capable of searching for relationships or the lack of relationships. So you can even combine several sources to give you the context that you need.

I wrote a post about that recently: SOCs: why they struggle with context