Kaspersky security center mapping to Enterprise Security

[abwe]

I've recently indexed kaspersky security center 10 data in splunk, but malware center in enterprise security showed nothing.
I found the following add-on "TA-kaspersky https://github.com/devBusters/TA-kaspersky " and used it but got nothing.
After that I modified some regex values in it on the following repo "TA-kaspersky https://github.com/barakat-abweh/TA-kaspersky
" on my github and still modifying it and managed to get malware center dashboard working but still having some problems with fields calculation eg:- action,category ... etc anything i do it keep showing unknown.

Any help? or if any one wants to help in developing the add-on you are welcome

[diogofgm]

I've been making some improvements in the add-on. Check the version of the add-on I've released in Splunkbase.

[jnudell_2]

Hi @abwe ,
The important thing to have working for Enterprise Security is CIM compliance. This essentially means that fields are "normalized" according to the CIM that ES uses. Additionally, the events have to have the proper eventtypes and tags associated with the data source.
To learn how to make your data CIM compliant you can reference the CIM documentation:
https://docs.splunk.com/Documentation/CIM/4.13.0/User/Overview

As for the app you are referencing, it is not a Splunk approved or supported app. While that's not a requirement, it makes things a lot easier when you can find an app that has already been vetted to be compatible with Splunk and the most recent CIM version. Unfortunately, Kaspersky Security Center 10 does not appear to have a CIM compliant app on Splunkbase, so you're on your own for making it work with Enterprise Security.
If you don't have the required knowledge and/or time to make your data work with ES, you might be better off looking at Splunk Professional Services to handle this for you.

[abwe]

Hi @jnudell_2 ,

I'm trying to get malware center running with kaspersky, I've added a regex to extract data, added tags and event types mentioned in the following document https://docs.splunk.com/Documentation/CIM/4.13.0/User/Malware and still getting no results found