Splunk Enterprise Security

cvss score result not available in Splunk Enterprise Security module

New Member

Hi Experts,

I am trying to setup a glasstable containing the result from cvss score field.

I seem to get other result related to this (CVE, crticality level etc.) but the cvss field is not extracted. I can see that the field is available in the "vulnerability" datamodel.

Thanks

0 Karma

New Member

How and what do I edit in the data model to extract the data. Have not been able to find information about this online

0 Karma

SplunkTrust
SplunkTrust

Is the CVSS score field present in your events? The datamodel can't extract what's not in the data.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

With events do you mean incident review panel? the cvss score is not showed in either the incident review panel or in search results.

0 Karma

New Member

The field is not present in the search result

0 Karma

New Member

I can see the cvss score result in my splunk module where i have Qualys app installed. Its just in my SIEM i cant see it

0 Karma

SplunkTrust
SplunkTrust

So the CVSS score field is present , but is not being extracted by the data model. You'll need to edit the data model to extract the field from your events.

---
If this reply helps you, an upvote would be appreciated.
0 Karma