Splunk Enterprise Security

found x unexpected values

splunkcol
Builder

I am using the APP "SA-cim_vladiator" and this message appears indicating that it has found unexpected values

In this order of ideas it is only analyzing me and detecting the logs with the action = allowed field

And those that in the value action = Accept or suscces or pass are not detecting them

The same happens for blocked where drop or deny are not detected in the action field

How can I solve this situation?

 

splunkcol_0-1609175995749.png

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi, @splunkcol,

- First you should check index constraints  for Network_Traffic model. If this macro is not set, you should set indexes that has traffic data.

 - Install CIM compatible TA's for network traffic sources. (With ES this applies to all sourcetypes that feeds datamodels)

- Even using CIM compatible TA's may not resolve all problems. You should map all invalid values to valid recommended ones (allowed, blocked, teardown) using FIELDALIAS, EVAL or lookups.

You can use https://docs.splunk.com/Documentation/CIM/4.18.0/User/NetworkTraffic as a reference.

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...