How do I populate vuln_signature_reference2.csv in order to show data in the New Vulnerabilities panel in the Vulnerability Center dashboard?

[windbishn]

I have made changes to the Vulnerabilities datamodel to support Nexpose vulnerability data and populate the Vulnerability Center dashboards. However, the last dashboard panel, New Vulnerabilities, reports no data which upon further investigation is getting the data from an empty vuln_signature_reference2.csv noted in the macro.conf file. I searched high and low for a solution but to no avail.

Thanks in advance.

[smoir_splunk]

According to the dashboard to data model table, that panel calls the vuln_signature_reference lookup (http://docs.splunk.com/Documentation/ES/4.2.0/User/DashboardMatrix#T_-_Z)

There is a saved search on the content management page, Vuln - New Vulnerabilities that (among other things) calls a macro vuln_signature_referencewhich if you look up in Settings > Advanced Search > Search Macros, does this: inputlookup append=T vuln_signature_reference

So I'd suggest modifying the saved search to support the changes you made to the data model. Let me know if this works!

[windbishn]

Thank you, at least I was heading in the right direction. I did make similar changes as with the data model and added index and eventtype, as suggested, to narrow down the data I would be working with.

index=nexpose eventtype=r7vulnerabilitydata| inputlookup append=T vuln_signature_reference

There is data according to this search which I would expect to now be appended to the vuln_signature_reference2.csv according to the transforms.conf but there is no data written to the file.

transforms.conf
[vuln_signature_reference]
filename = vuln_signature_reference2.csv

Perhaps my understanding of the macros.conf and transforms.conf, in this case, needs to be corrected?

macros.conf

Vulnerability Signature Reference

[get_vuln_signature_reference]
definition = lookup local=true vuln_signature_reference signature OUTPUTNEW cve,bugtraq,cert,msft,mskb,xref | makemv(cve) | makemv(bugtraq) | makemv(cert) | makemv(msft) | makemv(mskb) | makemv(xref) | fillnull value="" cve,bugtraq,cert,msft,mskb,xref

[vuln_signature_reference]
definition = inputlookup append=T vuln_signature_reference

Thanks again.