Dashboard for Cyberwatch

[OC34]

Hello,

I tried to import App Dashboard for Cyberwatch but dashboard display empty data.

My understanding, for the Data input, i should select the following:

• sourcetype = "cyberwatch:syslog"
• app context = "Cyberwatch (SA-cyberwatch)"
• index name = "cyberwatch"

But if i check the content of the dashboard, there is other source type:

• cbw:group
• cbw:node
• cbw:vuln
• ...

Can you clarify to make the Dashboard work from Cyberwatch syslog events?

Regards,

Olivier

[livehybrid]

Hi @OC34 

Can you confirm that the following search returns data for you?

index=cyberwatch sourcetype="cyberwatch:syslog"

The app you are referring to mentions it dashboards Cyberwatch informations, such as vulnerabilities, rules, assets, scans,discoveries but doesnt specifically mention syslog. Which dashboard is it you are looking to replicate?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing