RSS and alert

[machin90]

Hi,

I am subscribed to the NVD CVE rss feed that I receive via splunk.

When one device matches I have an alert. The issue is that when the RSS feed is updated (with us every 24 hours) it also updates the date and time of the event and therefore gives me the same alert as yesterday.

My alert check every day at 8.00 PM if new cve with my device.

For example, I receive one alert yesterday for new cve checkpoint and today I have receive the same  alert with the same cve.

index=main *Checkpoint* | table publish,cve,link

Could you help me?

Thanks.

[to4kawa]

sample:

1. source.csv(Splunk_folder/var/run/splunk/csv/source.csv )
source
/Applications/Splunk/var/log/splunk/metrics.log
/Applications/Splunk/var/log/splunk/mongod.log

2. alert query
| tstats count where index=_internal NOT [|inputcsv source.csv ] by source
| outputcsv append=t source

3. alerting
eventcount > 0

4. note

If you first create it with outputcsv, it will be the default folder.

[machin90]

Hi to4awa,

Thanks for idea, this my query:

index=main *Checkpoint*
| stats count by publish,cve,link
| table publish,cve,link,count
| search NOT [inputcsv cve.csv | fields cve]
| outputcsv append=t cve

My csv file is always fed so I have duplicates how to add only the missing cve ?

[to4kawa]

How about outputting to csv and including that csv in the search?

[machin90]

Hi to4awa,

Could you give me an example?