Why are the data models intrusion and malware only working in the app search?

paola92 — Wed, 31 Jan 2018 22:18:33 GMT

Hi, I'm using Security enterprise but the datamodels intrusion and malware are not working but if I use the app search I see results.

Can anyone help me?

I upload the result for the same search on different app.

Re: Why are the data models intrusion and malware only working in the app search?

jwelch_splunk — Fri, 02 Feb 2018 04:12:20 GMT

My guess would be that your app that is responsible for providing the eventtype/tags of ids and attack, does not meet the naming requirements of the App Imports regex in ES.

| rest /services/apps/local/SplunkEnterpriseSecuritySuite/import splunk_server=local
| rename title AS master
| fields master, import
| mvexpand import
| join type=left import [| rest /services/apps/local splunk_server=local
| fields title, disabled | rename title AS import]

If you app is not listed here proceed to
a. renaming your app so the regex picks it up
b. modifying the regex so it can pick up your non-standard naming convention.

You can modify the regex in the UI under settings/data inputs/ App Imports or via conf file... Here is the default example... /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/default/inputs.conf

[app_imports_update://update_es]
app_regex         = (appsbrowser)|(search)|([ST]A-.*)|(Splunk_[ST]A_.*)|(DA-ESS-.*)|(Splunk_DA-ESS_.*)
app_exclude_regex = sideview_utils
app_include_list  = Splunk_DA-ESS_PCICompliance
apps_to_update    = (SA-.*)|(Splunk_SA_.*)
# Leave this disabled, this input will be enabled in setup
disabled          = 1
interval          = 60

Hope this helps: Here is a link the docs on this:
https://docs.splunk.com/Documentation/ES/4.7.4/Install/ImportCustomApps

topic Re: Why are the data models intrusion and malware only working in the app search? in Splunk Search

Why are the data models intrusion and malware only working in the app search?

Re: Why are the data models intrusion and malware only working in the app search?