Splunk Enterprise Security

Trend Micro officescan and deepsecurity sourcetype as not papulating in Malware datamodel

rashid47010
Communicator

Maily I have three sourcetypes
sourcetype=Officescan ( workstation logs( signature update, malware etc)
sourcetype = deepsecurity ( servers, malware logs)
sourcetype = trendmicro ( TrendMicro Control centre logs)

I can see the sourecetype=trendmicro with tag=malware. but other I can't see although they have also tag=malware.

secondly how can I made the app CIM compliant.

0 Karma
1 Solution

rashid47010
Communicator

In continuation of above, I install the TA_officescan TA on search head and on ES.
on search Head I can see the proper field extration and tags assosication. whereas In ES i cant see field extration NOR tag association.
am i missing something.?

View solution in original post

0 Karma

rashid47010
Communicator

In continuation of above, I install the TA_officescan TA on search head and on ES.
on search Head I can see the proper field extration and tags assosication. whereas In ES i cant see field extration NOR tag association.
am i missing something.?

0 Karma

rashid47010
Communicator

Answering to myself:

the naming convention for splunk apps to be appear in Splunk ES.

Referrence URL: https://docs.splunk.com/Documentation/ES/4.1.0/Install/InstallTechnologyAdd-ons#Import_add-ons_with_...

0 Karma

amankhan1
Path Finder

HI Rashid, which TA did you use for officescan?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...