Reporting

Infosec App won't show events

davoguz
New Member

Hello all,

I have installed the Infosec app and after following instructions, installing the necessary add ons, configuring CIM and creating tags, it just won't show any information on the VPN dashboard. It only shows the list of 100 VPN events at the very bottom. I've tried to confirm that the tags are configured correctly by testing with pivots but I get none. then I found that I can click on some of the dashboards (failed VPN authentications for example) and it will open a search page that contains:

`infosec-indexes` tag=vpn user="*" NOT action IN (block*,drop*,fail*)

And will show information but that search is not the one that is done by the main page:

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Network_Sessions.All_Sessions where nodename=All_Sessions.VPN NOT All_Sessions.action IN (drop*,fail*,block*) All_Sessions.user="$user1$"

Can anyone help me figure out what is the piece that I'm missing to get this working?

I appreciate your help.

David

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...