Sophos App For Splunk - Can whomever created this app please fix some things, so that others don't have to go through the pain that I have gone through?

[michael_schmidt]

Please Fix the Usage Summary page.
Grammatical Errors: "Hosts by Event"? How about "Events by Host" and "Events by User" which is what you're actually measuring.

Also if you're going to Limit it to the Top 10, You should say that you're limiting it, and it should actually show the hosts within the top 10 of event counts, and not just the alphabetically first 10 host names. Anyone else notice that each host only has 1 event attributed to it, and that the pie chart is nice and evenly spaced. Guess what? That doesn't happen in the real world.

Current search:
Host by Event
sourcetype=sophos* $customer$ |dedup id | top limit=10 location | stats count by location
Should Be:
Top 10 Hosts by Count of Events
sourcetype=sophos* $customer$ | spath |dedup id | eventstats count by location | top limit=10 location
Current Search:
Users by Event
sourcetype=sophos* $customer$ |dedup id | top limit=10 source |stats count by source
Should be:
Top 10 Users by Count of Events
sourcetype=sophos* $customer$ |dedup id |eventstats count by source | top limit=10 source
Current Search:
Actions by Type
sourcetype=sophos* $customer$ |dedup id | top limit=10 group | stats count by group
Should Be:
Top 10 Event Action Types
sourcetype=sophos* $customer$ |dedup id | eventstats count by group | top limit=10 group

[michael_schmidt]

Additionally, the the API expiration alert will ALWAYS fire as it's currently written. The search is written to get 1 event (per the "dedup customer_name" portion of the search). Eval is done to determine the number of days left before the API expires, but that's not taken into account by the alert The alert is fired whenever the number of results of the search are less than 30.

The number of results of the search are ALWAYS 1 which is always less than 30. Therefore the alert always fires.

Add this:

| search "Days Left"<30
to the end of the API Expiration Alert search and change the alert to fire whenever the results are GREATER than 0, and you'll achieve the desired effect of firing the alert whenever there's less than 30 days before the API expires.