Dashboards & Visualizations

Dashboard for Cyberwatch

OC34
New Member

Hello,

I tried to import App Dashboard for Cyberwatch but dashboard display empty data.

My understanding, for the Data input, i should select the following:

  • sourcetype = "cyberwatch:syslog"
  • app context = "Cyberwatch (SA-cyberwatch)"
  • index name = "cyberwatch"

But if i check the content of the dashboard, there is other source type:

  • cbw:group
  • cbw:node
  • cbw:vuln
  • ...

Can you clarify to make the Dashboard work from Cyberwatch syslog events?

Regards,

Olivier

Labels (1)
0 Karma

livehybrid
Ultra Champion

Hi @OC34 

Can you confirm that the following search returns data for you?

index=cyberwatch sourcetype="cyberwatch:syslog"

The app you are referring to mentions it dashboards Cyberwatch informations, such as vulnerabilities, rules, assets, scans,discoveries but doesnt specifically mention syslog. Which dashboard is it you are looking to replicate?

:glowing_star: Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...