Splunk Enterprise Security

cvss score result not available in Splunk Enterprise Security module

tfrandsen
New Member

Hi Experts,

I am trying to setup a glasstable containing the result from cvss score field.

I seem to get other result related to this (CVE, crticality level etc.) but the cvss field is not extracted. I can see that the field is available in the "vulnerability" datamodel.

Thanks

0 Karma

tfrandsen
New Member

How and what do I edit in the data model to extract the data. Have not been able to find information about this online

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is the CVSS score field present in your events? The datamodel can't extract what's not in the data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

tfrandsen
New Member

With events do you mean incident review panel? the cvss score is not showed in either the incident review panel or in search results.

0 Karma

tfrandsen
New Member

The field is not present in the search result

0 Karma

tfrandsen
New Member

I can see the cvss score result in my splunk module where i have Qualys app installed. Its just in my SIEM i cant see it

0 Karma

richgalloway
SplunkTrust
SplunkTrust

So the CVSS score field is present , but is not being extracted by the data model. You'll need to edit the data model to extract the field from your events.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...