Thx for the clarification If I wanted to add additional fields from the lookup file, such as Full Name, Dept #, while still matching only those user names in the lookup file, how would I perform that search? Thx ... View more

Good to go! Thx again and I greatly appreciate all of the help in hammering this out to what I was looking for. ... View more

Using the search below (after the last eval line), I see a table of week_month, zone, count, rank, with the sort order being week_month and rank (and obviously count is sorted as well from highest to smallest) | stats count by week_month,zone | sort - week_month count | streamstats count AS rank BY week_month | sort week_month rank Thx ... View more

My search is now set as below and returns the zones ranked 1-5 for each week, listed in order by week (I had a typo in which I didn't the lookup command for the second line). index="foo" sourcetype=foo host="foo | lookup ip_cidr.csv cidr_range as src | eval firewall=coalesce(firewall,"null") | eval context=coalesce(context,"null") | eval zone=coalesce(zone,"null") | eval week_month=strftime(_time, "%V") | bucket span=7d _time | stats count by week_month,zone | sort - week_month count | streamstats count AS rank BY week_month | where rank<=5 ... View more

I have and I'm waiting for his reply Thx ... View more

Also, dumping out to a table in Splunk, I'm seeing the same zone listed multiple times per week, whereas I would think that each zone should only be listed once. Perhaps there's an issue with my command | eval week_month=strftime(_time, "%V") ? Thx ... View more

Thx - I did click accept as the answer worked 1) I did remove the - in the sort as below, but I'm not seeing the inverse | sort 0 count | streamstats count AS rank BY week_month zone | eventstats first(rank) AS rank BY count week_month zone | stats avg(rank) BY zone is the avg(rank) based on the count using streamstats/eventstats? I dumped seven days of data into Excel and mocked up what I'm looking for and I'm seeing a different outcome re: rank/avg rank 11/30/2017 12/1/2017 12/2/2017 12/3/2017 12/4/2017 12/5/2017 12/6/2017 12/7/2017 Zone 1 0 44 86685 31 46 13 25 13 Zone 2 2 511 457 457 509 562 509 509 Zone 3 0 4263 803 803 3803 837 805 803 Zone 4 98 543 719 272 552 751 1341 769 Zone 5 3648 2428 1856 1331 3804 3439 2968 250 Zone 6 169 165 165 165 141 179 528 14 Zone 7 254 222 174 154 250 248 224 0 Zone 8 340 395 320 130 435 450 360 0 Zone 9 292 801 401 360 505 451 481 434 Zone 10 172 129 59 59 502 214 186 215 Zone 11 118 157 354 189 158 189 232 40 Rank: Day 1 Day 2 Day 3 Day 4 Day 5 Day 6 Day 7 Avg Ranking Zone 1 10 11 1 11 11 11 11 9.4 Zone 2 9 5 5 3 4 4 5 5.0 Zone 3 10 1 3 2 2 2 3 3.3 Zone 4 8 4 4 5 3 3 2 4.1 Zone 5 1 2 2 1 1 1 1 1.3 Zone 6 6 8 10 7 10 10 4 7.9 Zone 7 4 7 9 8 8 7 9 7.4 Zone 8 2 6 8 9 7 6 7 6.4 Zone 9 3 3 6 4 5 5 6 4.6 Zone 10 5 10 11 10 6 8 10 8.6 Zone 11 7 9 7 6 9 9 8 7.9 Thx ... View more

Thx for the reply and the search. A few quick questions 1) Is it possible to create an inverse so that the lowest avg ranking (avg(rank)) is listed as 1, second lowest average is listed as 2, etc.? 2) Is it possible to see the weekly data for each zone? 3) How hard would it be to compare a zone’s week against it’s previous week to see what the % change is (either up or down?) So for Zone 1 I’d like to compare week 2 to week 1 to see what the % change is, then week 3 to week 2, and so on. Each zone would have a % comparison allowing me to see the % up or down for each zone. Thx again ... View more

I want to use zone (as it's more specific than firewall or context, but I have those broken out in case I need to use them), and I'd like to have all weeks in the data be listed (as I can see from week to week at a glance where each zone is ranked). However, it would be great to implement being able to specify a week number passed in a token to see data for that week as well. Thx ... View more

TYVM - very helpful and illuminating. Thinking more about the when I calculate the avg, the ...| stats avg(duration) AS average_duration BY Host is calculating the avg time to mitigate of all vulnerabilities for a host, correct? For example, say Host A has 10 vulnerabilities and vuln 1 is mitigated in two days, then vuln 2 is mitigated on 5 days, etc., the calculation is looking at the duration off all 10 vulnerabilities combined. And I agree, I'm better served by two separate tables. Thx again ... View more

Thx again 3rd time is the charm and I should be typo free (I hope). Another two questions if you don't mind: 1) How could I create a list for each bucket group by host? For example, I'd like the list to look like as follows: duration group Host 10-30d system 1 system 5 system 11 <10d system 2 system 4 >30d system 3 system 6 2) How could I show the average amount of days it takes before a vulnerability is mitigated/patched by host? Thx ... View more

Thx again for catching another typo! I know have the following eval statement: | eval duration_group = case(duration < 10, "<10d", duration >= 10 AND duration <30, "10-30d", duration > 30, ">30d") ... View more

MuS, Thx million for the additional info. Plugged the syntax in and caught a bunch of stuff. Greatly appreciated! ... View more

TYVM for catching the typo! ... View more

Thx for the reply - greatly appreciated After digging around a bit, I came up with the following: index=nessus severity!=informational exploitAvailable=Yes | lookup ip_cidr.csv cidr_range as ip | eval firewall=coalesce(firewall,"null") | eval context=coalesce(context,"null") | eval zone=coalesce(zone,"null") | eval StartTime=strptime(firstSeen, "%Y-%m-%d %H:%M:%S") | eval EndTime=strptime(lastSeen, "%Y-%m-%d %H:%M:%S") | eval duration=strftime(lastSeen-firstSeen,"%d") | eval duration_group = case(duration < 10, "<10d", duration = 10 AND duration <30, "10-30d", duration < 30, ">30d") | chart count by duration_group Two ways to skin a cat as they say? ... View more

Digging into the scrip I saw the REST call was on port 8089 so when I double checked the relevant firewall, that port wasn't listed. Added that port and was able to pull the info via the REST call. Thx ... View more

I modified local/nessus.conf file as follows: [tenable_sc_settings] disable_ssl_certificate_validation = 1 and when I check the _internal index, I see the following events: 2017-11-21 14:20:07,924 +0000 log_level=ERROR, pid=19192, tid=MainThread, file=ta_mod_input.py, func_name=main, code_line_no=186 | Tenable task encounter exception Traceback (most recent call last): File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_mod_input.py", line 183, in main config_cls=configer_cls) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_mod_input.py", line 100, in run tconfig = tc.create_ta_config(settings, config_cls or tc.TaConfig) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_config.py", line 181, in create_ta_config return config_cls(meta_config, settings) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_config.py", line 21, in __init__ meta_config[c.session_key]) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktalib/splunk_cluster.py", line 26, in __init__ raise Exception("Failed to init ServerInfo") Exception: Failed to init ServerInfo 2017-11-21 14:20:07,924 +0000 log_level=ERROR, pid=19192, tid=MainThread, file=rest.py, func_name=splunkd_request, code_line_no=42 | Failed to send rest request=https://127.0.0.1:8089/services/server/info, errcode=unknown, reason=Traceback (most recent call last): File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktalib/rest.py", line 40, in splunkd_request headers=headers, body=data) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/httplib2/__init__.py", line 1609, in request (response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/httplib2/__init__.py", line 1351, in _request (response, content) = self._conn_request(conn, request_uri, method, body, headers) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/httplib2/__init__.py", line 1272, in _conn_request conn.connect() File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/httplib2/__init__.py", line 1075, in connect raise socket.error, msg error: [Errno 111] Connection refused ... View more

I am on version 5.1.2 for the Add-on, and I created the local/nessus.conf file and added the stanza below and then restarted Splunk [tenable_sc_settings] disable_ssl_certificate_validation = 0 Check the _internal events and I see: 2017-11-21 14:06:41,411 +0000 log_level=ERROR, pid=6351, tid=Thread-6, file=ta_data_collector.py, func_name=index_data, code_line_no=118 | [stanza_name="Nessus SC" data="sc_vulnerability" server="Security Center"] Failed to index data Traceback (most recent call last): File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 115, in index_data self._do_safe_index() File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 148, in _do_safe_index self._client = self._create_data_client() File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 95, in _create_data_client self._checkpoint_manager) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_client.py", line 55, in __init__ self._ckpt) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/ta_tenable_sc_data_collector.py", line 18, in do_job_one_time return _do_job_one_time(all_conf_contents, task_config, ckpt) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/ta_tenable_sc_data_collector.py", line 62, in _do_job_one_time raise Exception Exception 11/21/17 9:06:41.410 AM 2017-11-21 14:06:41,410 +0000 log_level=ERROR, pid=6351, tid=Thread-6, file=ta_tenable_sc_data_collector.py, func_name=_do_job_one_time, code_line_no=61 | [stanza_name="Nessus SC" data="sc_vulnerability" server="Security Center"] [SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed. The certificate validation is enabled. You may need to check the certificate and refer to the documentation and add it to the trust list. Thx ... View more

Still seeing SSL cert error even after setting setting disable_ssl_certificate_validation = 1 in local/nessus.conf: 11/20/17 12:26:22.062 PM 2017-11-20 17:26:22,062 +0000 log_level=ERROR, pid=11762, tid=Thread-4, file=ta_tenable_sc_data_collector.py, func_name=_do_job_one_time, code_line_no=61 | [stanza_name="Nessus Security Center" data="sc_vulnerability" server="Security Center"] [SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed. The certificate validation is enabled. You may need to check the certificate and refer to the documentation and add it to the trust list. ... View more

I'm seeing the following after setting disable_ssl_certificate_validation = 0 in local/nessus.conf: 11/20/17 12:18:37.540 PM 2017-11-20 17:18:37,540 +0000 log_level=ERROR, pid=3965, tid=Thread-5, file=ta_data_collector.py, func_name=index_data, code_line_no=118 | [stanza_name="Nessus Security Center" data="sc_vulnerability" server="Security Center"] Failed to index data Traceback (most recent call last): File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 115, in index_data self._do_safe_index() File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 148, in _do_safe_index self._client = self._create_data_client() File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 95, in _create_data_client self._checkpoint_manager) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_client.py", line 55, in __init__ self._ckpt) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/ta_tenable_sc_data_collector.py", line 18, in do_job_one_time return _do_job_one_time(all_conf_contents, task_config, ckpt) File "/data/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/ta_tenable_sc_data_collector.py", line 62, in _do_job_one_time raise Exception Exception 11/20/17 12:18:37.539 PM 2017-11-20 17:18:37,539 +0000 log_level=ERROR, pid=3965, tid=Thread-5, file=ta_tenable_sc_data_collector.py, func_name=_do_job_one_time, code_line_no=61 | [stanza_name="Nessus Security Center" data="sc_vulnerability" server="Security Center"] [SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed. The certificate validation is enabled. You may need to check the certificate and refer to the documentation and add it to the trust list. 11/20/17 12:18:37.521 PM 2017-11-20 17:18:37,521 +0000 log_level=INFO, pid=3965, tid=Thread-5, file=ta_tenable_sc_data_collector.py, func_name=_do_job_one_time, code_line_no=42 | [stanza_name="Nessus Security Center" data="sc_vulnerability" server="Security Center"] Proxy is disabled. 11/20/17 12:18:37.521 PM 2017-11-20 17:18:37,521 +0000 log_level=INFO, pid=3965, tid=Thread-5, file=ta_tenable_sc_data_collector.py, func_name=_do_job_one_time, code_line_no=39 | [stanza_name="Nessus Security Center" data="sc_vulnerability" server="Security Center"] The disable_ssl_certificate_validation is False 11/20/17 12:18:37.521 PM 2017-11-20 17:18:37,521 +0000 log_level=INFO, pid=3965, tid=Thread-5, file=ta_tenable_sc_data_collector.py, func_name=_do_job_one_time, code_line_no=23 | [stanza_name="Nessus Security Center" data="sc_vulnerability" server="Security Center"] Enter _do_job_one_time(). 11/20/17 12:18:37.520 PM 2017-11-20 17:18:37,520 +0000 log_level=INFO, pid=3965, tid=Thread-5, file=ta_data_collector.py, func_name=index_data, code_line_no=112 | [stanza_name="Nessus Security Center" data="sc_vulnerability" server="Security Center"] Start indexing data for checkpoint_key=Nessus%20Security%20Center___sc_vulnerability___Security%20Center 11/20/17 12:18:37.518 PM 2017-11-20 17:18:37,518 +0000 log_level=INFO, pid=3965, tid=Thread-2, file=scheduler.py, func_name=get_ready_jobs, code_line_no=100 | Get 1 ready jobs, next duration is 43199.999063, and there are 1 jobs scheduling ... View more