Hello all,
I have installed the Infosec app and after following instructions, installing the necessary add ons, configuring CIM and creating tags, it just won't show any information on the VPN dashboard. It only shows the list of 100 VPN events at the very bottom. I've tried to confirm that the tags are configured correctly by testing with pivots but I get none. then I found that I can click on some of the dashboards (failed VPN authentications for example) and it will open a search page that contains:
`infosec-indexes` tag=vpn user="*" NOT action IN (block*,drop*,fail*)
And will show information but that search is not the one that is done by the main page:
| tstats summariesonly=true allow_old_summaries=true count from datamodel=Network_Sessions.All_Sessions where nodename=All_Sessions.VPN NOT All_Sessions.action IN (drop*,fail*,block*) All_Sessions.user="$user1$"
Can anyone help me figure out what is the piece that I'm missing to get this working?
I appreciate your help.
David
