All Apps and Add-ons
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Cisco AMP for Endpoints Events - JSON Vulnerable Application Detected Incomplete

jscraig2006
Communicator
‎05-27-2021 12:01 PM

@samsnguy_cisco 
Hi Samson,

The current version 2.0.1of Cisco AMP for Endpoints Events seems to cut off the "Vulnerable Application Detected" JSON. It appears if there is a large amount of CVE info, it tends to leave the event incomplete and does not format the JSON correctly. I don't know if it is the behavior of the response or not. When running the python manually, it appears to do the same thing from api.amp.cisco.com. A limitation of the size of the JSON response.  Would this be correct?

 

Thanks,

 

John

Labels (2)
Tags (1)
0 Karma
Reply
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...