Splunk Search

How can I get actual host names or IPs for Rapid7 Nexpose data in Splunk?

dshpritz
SplunkTrust
SplunkTrust

The Nexpose app uses the API to get data into Splunk. The problem is that the vulnerability events don't have actual host names or IPs in them, instead they have a list of the IDs of the hosts. As that ID is not referenced anywhere else in Splunk (for example, in a lookup file), the vulnerability events are almost useless. Is there a way to get the actual hostnames or IP addresses of the hosts?

Thanks.

Tags (1)

mln21
Engager

Hi dshpritz and thanks for your question. I work on the technical alliances team at Rapid7. Our current plan is to incorporate this feature into a future release of the Rapid7 Nexpose for Splunk App. To do this we are planning leveraging the Common Information Model. In addition to the asset names or the IP addresses, what other kinds of information would you find useful? We would love to hear feedback on the app and ways to make it better.

Thanks,
Martin

stinnett
New Member

Hi Martin,

Is there any eta for this release?

Thanks,

Jon

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...