All Apps and Add-ons

Cannot get Infosec App to work

wbueno2
Explorer

Hello there,

I would like to know what I´m doing wrong? I´m sending all logs sugested by the app but it seems something is wrong. Can anyone please help me to get this sorted?

alt text

1 Solution

igifrin_splunk
Splunk Employee
Splunk Employee

Hi @wbueno2, as others pointed out, CIM compliant data is a must for the InfoSec app to work. Here is what you may want to do:

  1. Review the installation instructions for the InfoSec app
    • Check whether you have the CIM add-on installed
    • Accelerate the data models (Settings>Data Models) listed in the instructions
  2. Check whether you use CIM-compliant add-ons for your data. In your case, for example, you should have Cisco ASA and Windows add-ons installed on your Splunk server (or Search Heads in distributed environment). Check installation instructions for the add-ons.
  3. Go to InfoSec app > Health and Stats and check the following two tables:
    • "Data Models Used by the InfoSec App: Events in Past 24 Hours"
    • "All Data Models: Status" (You may need to wait from 5 minutes to an hour or more depending how much data you are sending to Splunk and how behind data models are on acceleration)
  4. If you see only red in the tables above, your data is not CIM compliant and/or data models are not accelerated. This is where you may want to look at these two resources:

View solution in original post

igifrin_splunk
Splunk Employee
Splunk Employee

Hi @wbueno2, as others pointed out, CIM compliant data is a must for the InfoSec app to work. Here is what you may want to do:

  1. Review the installation instructions for the InfoSec app
    • Check whether you have the CIM add-on installed
    • Accelerate the data models (Settings>Data Models) listed in the instructions
  2. Check whether you use CIM-compliant add-ons for your data. In your case, for example, you should have Cisco ASA and Windows add-ons installed on your Splunk server (or Search Heads in distributed environment). Check installation instructions for the add-ons.
  3. Go to InfoSec app > Health and Stats and check the following two tables:
    • "Data Models Used by the InfoSec App: Events in Past 24 Hours"
    • "All Data Models: Status" (You may need to wait from 5 minutes to an hour or more depending how much data you are sending to Splunk and how behind data models are on acceleration)
  4. If you see only red in the tables above, your data is not CIM compliant and/or data models are not accelerated. This is where you may want to look at these two resources:

View solution in original post

mydog8it
Builder

Have you reviewed the setup requirements? Must be CIM compliant data with acceleration on required data models...
https://splunkbase.splunk.com/app/4240/#/details

wbueno2
Explorer

How can I make sure the data is coming is CIM compliant? Apart from that I followed all the steps.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What are you expecting to see?

---
If this reply helps you, an upvote would be appreciated.

wbueno2
Explorer

There´s no data coming to infosec.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!