Splunk Enterprise Security

found x unexpected values

splunkcol
Builder

I am using the APP "SA-cim_vladiator" and this message appears indicating that it has found unexpected values

In this order of ideas it is only analyzing me and detecting the logs with the action = allowed field

And those that in the value action = Accept or suscces or pass are not detecting them

The same happens for blocked where drop or deny are not detected in the action field

How can I solve this situation?

 

splunkcol_0-1609175995749.png

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi, @splunkcol,

- First you should check index constraints  for Network_Traffic model. If this macro is not set, you should set indexes that has traffic data.

 - Install CIM compatible TA's for network traffic sources. (With ES this applies to all sourcetypes that feeds datamodels)

- Even using CIM compatible TA's may not resolve all problems. You should map all invalid values to valid recommended ones (allowed, blocked, teardown) using FIELDALIAS, EVAL or lookups.

You can use https://docs.splunk.com/Documentation/CIM/4.18.0/User/NetworkTraffic as a reference.

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

SOC Modernization: How Automation and Splunk SOAR are Shaping the Next-Gen Security ...

Security automation is no longer a luxury but a necessity. Join us to learn how Splunk ES and SOAR empower ...

Ask It, Fix It: Faster Investigations with AI Assistant in Observability Cloud

  Join us in this Tech Talk and learn about the recently launched AI Assistant in Observability Cloud. With ...

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...