All Apps and Add-ons

Infosec App for Splunk - wrong number of Hosts and Accounts

ennis01
Explorer

On the main dashboard of the InfoSec App for Splunk, under Hosts and Accounts it is showing ~87,000 hosts and accounts, which is way off, but I can't figure out why. Does anyone know what would cause this? I assume it has something to do with the InfoSec-indexes macro, but I don't know how to troubleshoot it. Thanks in advance for assistance.

Tags (1)
1 Solution

igifrin_splunk
Splunk Employee
Splunk Employee

Hi @ennis01, hosts and accounts numbers are taken from the data that gets to your Splunk instance:
- Hosts number is taken from the distinct host names from field host
- Accounts number is taken from distinct user names from authentication events

infosec-indexes macro may or may not be an issue here. By default infosec-indexes is just index=* (and you can modify it to only cover the indexes you need in Settings>Advanced search>Search macros).

You may want to run a search like this to see the what the host field values are in your environment:

`infosec-indexes` | stats count by host

View solution in original post

igifrin_splunk
Splunk Employee
Splunk Employee

Hi @ennis01, hosts and accounts numbers are taken from the data that gets to your Splunk instance:
- Hosts number is taken from the distinct host names from field host
- Accounts number is taken from distinct user names from authentication events

infosec-indexes macro may or may not be an issue here. By default infosec-indexes is just index=* (and you can modify it to only cover the indexes you need in Settings>Advanced search>Search macros).

You may want to run a search like this to see the what the host field values are in your environment:

`infosec-indexes` | stats count by host

ennis01
Explorer

Thanks, this helped. Source of the 'disinformation' is the sidewinder log. I'm unsure if this data is CIM compliant, but it looks to be mislabeling a time field as 'host'.

0 Karma

ennis01
Explorer

So, now the question is, how do I deselect 'host' as a selected field for the sidewinder index in the macro?

0 Karma

igifrin_splunk
Splunk Employee
Splunk Employee

If Sidewinder timestamps end up in 'host' field you would want to fix that first. You can completely exclude the index with Sidewinder events from what the InfoSec app sees but that is likely not the best approach in your case.

If you use this Sidewinder add-on from Splunk base, there may be a need to tighten the regex for host field in transforms.conf.

If you work with anyone who onboards data into Splunk, ask them how to fix the host field extraction. You can also do your own research as there is no shortage of documentation. You can also post a separate question here to ask for help.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...