All Apps and Add-ons

why is the URL field in the Splunk Add-on for Cisco CWS sometimes empty?

stefan1988
Path Finder

The Splunk Add-on for Cisco CWS: url field is sometimes empty causing DM vulnerabilities in Enterprise Security filling up with unknown field values.

0 Karma
1 Solution

piebob
Motivator

This is because url is build from 4 parts (cs_uri_scheme + "://" + cs_host + cs_uri_path + "?" + cs_uri_query) and when cs_uri_query is empty url will be empty.

Please adjust the TA and in props.conf instead of:
EVAL-url = cs_uri_scheme + "://" + cs_host + cs_uri_path + "?" + cs_uri_query

use:
EVAL-url = case(len(cs_uri_query)>0 AND len(cs_uri_path)>0,cs_uri_scheme + "://" + cs_host + cs_uri_path + "?" + cs_uri_query,
len(cs_uri_path)>0,cs_uri_scheme + "://" + cs_host + cs_uri_path,
1==1,cs_uri_scheme + "://" + cs_host)

View solution in original post

0 Karma

piebob
Motivator

This is because url is build from 4 parts (cs_uri_scheme + "://" + cs_host + cs_uri_path + "?" + cs_uri_query) and when cs_uri_query is empty url will be empty.

Please adjust the TA and in props.conf instead of:
EVAL-url = cs_uri_scheme + "://" + cs_host + cs_uri_path + "?" + cs_uri_query

use:
EVAL-url = case(len(cs_uri_query)>0 AND len(cs_uri_path)>0,cs_uri_scheme + "://" + cs_host + cs_uri_path + "?" + cs_uri_query,
len(cs_uri_path)>0,cs_uri_scheme + "://" + cs_host + cs_uri_path,
1==1,cs_uri_scheme + "://" + cs_host)

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!