All Apps and Add-ons
Highlighted

Unable to find tag security

Builder

I am getting the error - Unable to find tag security on the below panels on the security posture dashboard.

360 View by Accounts: Event Types over

Search : `infosec-indexes (tag=security OR tag=attack) | eval tag=mvfilter(match(tag, "failure") OR match(tag, "success") OR match(tag, "access") OR match(tag, "add") OR match(tag, "change") OR match(tag, "delete") OR match(tag, "error") OR match(tag, "misconfiguration") OR match(tag, "vulnerability") OR match(tag, "attack") OR match(tag, "lock") OR match(tag, "cleared") OR match(tag, "email")) | stats count, dc(user) by date_hour, tag`

Time 360 View by hosts: Event Types over Time

I checked all the tags and there is no security tag but there are definitely mutiple tags called attack, still the search within the mentioned panels is not working.

Please advise.

Highlighted

Re: Unable to find tag security

Splunk Employee
Splunk Employee

Are you getting a warning message like the one on the screenshot below?

alt text

If that's the case, you should still see correct results on the dashboard panel for the data you have; you just don't have data with tag=security as you pointed out.

This may not be a bad warning to see. For example, it can be an indication that you don't have Windows security logs or you are not using Windows add-on that add the 'security' tag.