All Apps and Add-ons

Cannot get Infosec App to work

wbueno2
Explorer

Hello there,

I would like to know what I´m doing wrong? I´m sending all logs sugested by the app but it seems something is wrong. Can anyone please help me to get this sorted?

alt text

1 Solution

igifrin_splunk
Splunk Employee
Splunk Employee

Hi @wbueno2, as others pointed out, CIM compliant data is a must for the InfoSec app to work. Here is what you may want to do:

  1. Review the installation instructions for the InfoSec app
    • Check whether you have the CIM add-on installed
    • Accelerate the data models (Settings>Data Models) listed in the instructions
  2. Check whether you use CIM-compliant add-ons for your data. In your case, for example, you should have Cisco ASA and Windows add-ons installed on your Splunk server (or Search Heads in distributed environment). Check installation instructions for the add-ons.
  3. Go to InfoSec app > Health and Stats and check the following two tables:
    • "Data Models Used by the InfoSec App: Events in Past 24 Hours"
    • "All Data Models: Status" (You may need to wait from 5 minutes to an hour or more depending how much data you are sending to Splunk and how behind data models are on acceleration)
  4. If you see only red in the tables above, your data is not CIM compliant and/or data models are not accelerated. This is where you may want to look at these two resources:

View solution in original post

igifrin_splunk
Splunk Employee
Splunk Employee

Hi @wbueno2, as others pointed out, CIM compliant data is a must for the InfoSec app to work. Here is what you may want to do:

  1. Review the installation instructions for the InfoSec app
    • Check whether you have the CIM add-on installed
    • Accelerate the data models (Settings>Data Models) listed in the instructions
  2. Check whether you use CIM-compliant add-ons for your data. In your case, for example, you should have Cisco ASA and Windows add-ons installed on your Splunk server (or Search Heads in distributed environment). Check installation instructions for the add-ons.
  3. Go to InfoSec app > Health and Stats and check the following two tables:
    • "Data Models Used by the InfoSec App: Events in Past 24 Hours"
    • "All Data Models: Status" (You may need to wait from 5 minutes to an hour or more depending how much data you are sending to Splunk and how behind data models are on acceleration)
  4. If you see only red in the tables above, your data is not CIM compliant and/or data models are not accelerated. This is where you may want to look at these two resources:

mydog8it
Builder

Have you reviewed the setup requirements? Must be CIM compliant data with acceleration on required data models...
https://splunkbase.splunk.com/app/4240/#/details

wbueno2
Explorer

How can I make sure the data is coming is CIM compliant? Apart from that I followed all the steps.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What are you expecting to see?

---
If this reply helps you, Karma would be appreciated.

wbueno2
Explorer

There´s no data coming to infosec.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...