I am getting the error - Unable to find tag security
on the below panels on the security posture dashboard.
360 View by Accounts: Event Types over
Search : `infosec-indexes
(tag=security OR tag=attack) | eval tag=mvfilter(match(tag, "failure") OR match(tag, "success") OR match(tag, "access") OR match(tag, "add") OR match(tag, "change") OR match(tag, "delete") OR match(tag, "error") OR match(tag, "misconfiguration") OR match(tag, "vulnerability") OR match(tag, "attack") OR match(tag, "lock") OR match(tag, "cleared") OR match(tag, "email")) | stats count, dc(user) by date_hour, tag`
Time 360 View by hosts: Event Types over Time
I checked all the tags and there is no security tag but there are definitely mutiple tags called attack, still the search within the mentioned panels is not working.
Please advise.
Are you getting a warning message like the one on the screenshot below?
If that's the case, you should still see correct results on the dashboard panel for the data you have; you just don't have data with tag=security as you pointed out.
This may not be a bad warning to see. For example, it can be an indication that you don't have Windows security logs or you are not using Windows add-on that add the 'security' tag.