Different data from Splunk and Sophos Central

[zksvc]

Dear Everyone,

I would like to create a custom correlation search to identify hostnames that have not been updated in one month or 30 days or longer. However, upon finalizing my query, I encountered a discrepancy in the data. For instance, I found that the hostname "ABC" has not been updated for 41 days; however, when I checked in Sophos Central via the website, it indicated "No Devices Found." I am inquiring about how Splunk is able to read this data while Sophos Central reports that the device is not found.

Thank you for your assistance.

[zksvc]

I have not set up the ingest from Sophos to Splunk yet. I am currently looking to create a custom correlation search. However, if you know how to verify the data, please let me know.

The query I've crafted clearly identifies all the necessary details such as hostname, IP, and username. The issue of uppercase/lowercase is not a problem, as it only requires output without the need to compare data.

I've been quite troubled trying to sort this out, which has led me to this point.

[gcusello · Accepted solution]

Hi @zksvc ,

you could extract from splunk the list of hostnames with a simple search index=* | stats count BY host.

Then you could elaborate these results e.g. using nslookup to have the hostnames when you have the IPs and viceversa, at the same time, when you have an FQDN, you could extract the hostname using a regex, but it depends on your data.

In this way, you couls have a list of hosts whose logs are monitored by Splunk and you can match them with the Sophos list using e.g. Excel.

Otherwise, if you planned to ingest Sophos logs in Splunk, you can do this match in Splunk.

Ciao.

Giuseppe

[zksvc]

Hi @gcusello 
Nice idea my friend, thanks for your answer

Danke 

Zake

[gcusello]

Hi @zksvc ,

you're asking of data quality: how data are ingested in Splunk?

is this input the same of Sophos?

then, you shuld analyze if there's some difference caused by the hostname extraction: Ip instead hostname, FQDN or hostname, uppercase or lowercase?

You should perform an analysis on the hostnames and Splunk gives you all the tools to search and analyze them.

Ciao.

Giuseppe