All Apps and Add-ons

Expected field value for x_exception_id not present

3DGjos
Communicator

Hello, i'm installing the proxysg app for a client. I've got it all covered but the only panels I cant get to work are the ones who are expecting this value x_exception_id=virus_detected.

I've found lots of x_exception_id=policy_denied events instead. with malware detections associated to them, but no "virus_detected". So i cant populate those panels.

the fields im sending from proxysg's side are:
date time time-taken c-ip cs-username cs-auth-group x-exception-id sc-filter-result cs-categories cs(Referer) sc-status s-action cs-method rs(Content-Type) cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-uri-extension cs(User-Agent) s-ip sc-bytes cs-bytes x-virus-id x-bluecoat-application-name x-bluecoat-application-operation

Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...