Infosec App for Splunk - wrong number of Hosts and Accounts

[ennis01]

On the main dashboard of the InfoSec App for Splunk, under Hosts and Accounts it is showing ~87,000 hosts and accounts, which is way off, but I can't figure out why. Does anyone know what would cause this? I assume it has something to do with the InfoSec-indexes macro, but I don't know how to troubleshoot it. Thanks in advance for assistance.

[igifrin_splunk · Accepted solution]

Hi @ennis01, hosts and accounts numbers are taken from the data that gets to your Splunk instance:
- Hosts number is taken from the distinct host names from field host
- Accounts number is taken from distinct user names from authentication events

infosec-indexes macro may or may not be an issue here. By default infosec-indexes is just index=* (and you can modify it to only cover the indexes you need in Settings>Advanced search>Search macros).

You may want to run a search like this to see the what the host field values are in your environment:

`infosec-indexes` | stats count by host

[ennis01]

Thanks, this helped. Source of the 'disinformation' is the sidewinder log. I'm unsure if this data is CIM compliant, but it looks to be mislabeling a time field as 'host'.

[ennis01]

So, now the question is, how do I deselect 'host' as a selected field for the sidewinder index in the macro?

[igifrin_splunk]

If Sidewinder timestamps end up in 'host' field you would want to fix that first. You can completely exclude the index with Sidewinder events from what the InfoSec app sees but that is likely not the best approach in your case.

If you use this Sidewinder add-on from Splunk base, there may be a need to tighten the regex for host field in transforms.conf.

If you work with anyone who onboards data into Splunk, ask them how to fix the host field extraction. You can also do your own research as there is no shortage of documentation. You can also post a separate question here to ask for help.