Splunk Search

How to match my list of qualys events against the list of CVEs found in the KEV lookup?

TheBravoSierra
Path Finder

Hi,

I'm looking to match my list of qualys events against the list of CVEs found in the KEV lookup on cisa.gov. I'm not having any success with the below search.  Can you provide any guidance? 

For example,

 index=qualys  *[|inputlookup cisa_cve.csv | fields cveID]*

I need to find my events where my base search that shows CVE contains matches to the KEV lookup returned field. 

Any help is greatly appreciated.

Thanks

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @TheBravoSierra,

you cannot put a subsearch adding the asterisks in main search, you have to modify your search.

In addition, have you the cveID field both in the lookup and in the qualys index? remeber that to use a subsearch you need to have the same field name both in main search and subsearch.

Anyway, you could run something like this:

index=qualys [ | inputlookup cisa_cve.csv | rename cveID AS query | fields query ]
| ...

in this way you make a full text search in the qualys index using the lookup cveID field.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...