topic RSS and alert in Alerting

RSS and alert

machin90 — Wed, 25 Nov 2020 00:39:58 GMT

Hi,

I am subscribed to the NVD CVE rss feed that I receive via splunk.

When one device matches I have an alert. The issue is that when the RSS feed is updated (with us every 24 hours) it also updates the date and time of the event and therefore gives me the same alert as yesterday.

My alert check every day at 8.00 PM if new cve with my device.

For example, I receive one alert yesterday for new cve checkpoint and today I have receive the same alert with the same cve.

index=main *Checkpoint* | table publish,cve,link

Could you help me?

Thanks.

Re: RSS and alert

to4kawa — Wed, 25 Nov 2020 00:58:53 GMT

How about outputting to csv and including that csv in the search?

Re: RSS and alert

machin90 — Wed, 25 Nov 2020 20:54:26 GMT

Hi to4awa,

Could you give me an example?

Re: RSS and alert

to4kawa — Thu, 26 Nov 2020 08:32:40 GMT

sample:

1. source.csv(Splunk_folder/var/run/splunk/csv/source.csv )
source
/Applications/Splunk/var/log/splunk/metrics.log
/Applications/Splunk/var/log/splunk/mongod.log

2. alert query
| tstats count where index=_internal NOT [|inputcsv source.csv ] by source
| outputcsv append=t source

3. alerting
eventcount > 0

4. note

If you first create it with outputcsv, it will be the default folder.

Re: RSS and alert

machin90 — Fri, 27 Nov 2020 01:41:17 GMT

Hi to4awa,

Thanks for idea, this my query:

My csv file is always fed so I have duplicates how to add only the missing cve ?