Hey bpatel, That is actually a better solution than what I was going to do. Using the datamodel makes the most sense. Below is the final query using that suggestion. | tstats summariesonly count from datamodel=Application_State.All_Application_State where nodename=All_Application_State.Processes by All_Application_State.process | drop_dm_object_name("All_Application_State") | drop_dm_object_name("Processes") | eval whitelist="whitelist" | append [| inputlookup whitelist_process | table process, whitelist ] | dedup process | table process, whitelist | outputlookup whitelist_process append=true However, there is one catch. Not every process we see should be whitelisted because those could be some malicious ones. I think I will still have to correlate with my known good from Bit9. Below is my final query using the data from Bit9. index=bit9 sourcetype=bit9 source=Event ProcessTrust>=8 | eval whitelist="whitelist" | append [| inputlookup whitelist_process | table process, whitelist ] | dedup process | table process, whitelist | outputlookup whitelist_process append=true ... View more

My guess is that I need to add the fullpath that includes the filename. That way its very specific. However, I am not sure how the logic is setup and whether or not it will know how to use that. ... View more

I am also seeing this error. Were you able to figure it out? ... View more

Is this file overwritten every time you upgrade? We are also experiencing this issue and looking for the most practical solution. ... View more

Working with support, I noticed that ES is not extracting the events properly in index=notable which leads to these unknown values. From what I am seeing, Splunk's extraction needs to be updated because they are expecting field="value" which means value needs to be surrounded by quotes. However, if your value has a backslash character before one of the quotes, the extraction breaks. Do a search in index=notable and find one of the events that isn't being extracted and look to see if you have anything that would break the extraction. ... View more

We are now experiencing the same issue. Did anyone ever figure this out? ... View more

Ah ok, using that exactly URL works on my search head. Not sure why I can't get to that page from the main Data Inputs. ... View more

Is that character correct after "modinput=1"? ... View more

Where did you find it? I am not seeing it and that URL doesn't work on 6.5. ... View more

We are now running into this issue and we are using 6.3.3. ... View more

We are also starting to see this same error. Hopefully someone has a solution. ... View more

For other people that might be trying to get this to work with Enterprise Security and have the results show up on your Malware dashboard, below is what I have done thus far. I am open to additional suggestions as well. Because the Bit9 app does not follow Splunk's naming convention, you will need to append the app to the stanza below: /appl/splunk/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf [app_imports_update://update_es] app_regex = (search)|([ST]A-.)|(Splunk_[ST]A_.)|(DA-ESS-.)|(Splunk_DA-ESS_.)|(bit9-secapp) Eventtypes - bit9-secapp/local/eventtypes.conf Because of the limitation with event types and not being able to use pipes or subsearches, I couldn't find a way that would correlate all of the necessary fields. Therefore, I am having to do a search against the Bit9 sourcetype and then send to the index with a new sourcetype "bit9:malware". If anyone has any other suggestions, I am open. [bit9_malware] search = index=bit9 sourcetype="bit9:malware" tags = malware attack Tags - bit9-secapp/local/tags.conf [eventtype=bit9_malware] malware = enabled attack = enabled Props - bit9-secapp/local/props.conf I am not certain on how the action field should be populated just yet because we just installed Bit9. Hopefully, after getting more data into the console and turning on blocking I will see the values I need. [bit9] Bit9 CIM Extractions FIELDALIAS-file_path_for_bit9 = PathName as file_path FIELDALIAS-file_hash_for_bit9 = FileHash as file_hash FIELDALIAS-file_name_for_bit9 = FileName as file_name FIELDALIAS-user_for_bit9 = UserName as user EVAL-vendor_product = "Bit9" EVAL-dest_nt_domain = mvindex(split(HostName, "\"),0) EVAL-action = if(like(GlobalState, "block%"), "blocked", "allowed") EVAL-dest = HostName EVAL-dest_ip = HostIP EVAL-date = strftime(_time,"%Y-%m-%d %H:%M:%S") EVAL-Sha256 = FileHash KV Store for File Catalog If you look at the Bit9 dashboard "File Investigation", it has the setting "latest=now earliest=1" when searching for file hashes. Which means this is running against all time which is fine for now since we just built this index. However, as time progresses this won't be feasible and will slow down our SH. Therefore, I built another search that will collect the results from the file catalog and then put them in a kvstore for quick searching. I ran this search with all time to get the results into the kvstore and then scheduled it to run every 5 minutes. Depending on how long it takes to complete, I might change this to every 10 minutes. I named my kvstore "kvstore_bit9_fileCatalog". Saved Search outside of the Bit9 app As I stated above, I had to send the results to a new sourcetype. Below is the search I created that runs every 15 minutes. I opted to create this outside of the Bit9 app because we might push this app to a couple of SHs and I don't want this saved search executing on all SHs. In addition, I haven't figured out if Bit9 is able to capture the signature of the malware. Currently I am using the Category field but I am finding that the values for this field are all "Unknown". eventtype=bit9_event (EventSubType="Potential risk file detected" OR EventSubType="Malicious file detected") | eval "SHA-256"=FileHash | lookup kvstore_bit9_fileCatalog FileHash AS FileHash OUTPUT FileSize AS file_size_bytes, Md5 AS MD5, Sha1 AS "SHA-1", Category AS signature, Publisher, TrustValue | stats latest(date) as date, latest(action) as action, latest(signature) as signature, latest(EventSubType) as EventSubType, latest(user) as user, latest(dest) as dest, latest(dest_ip) as dest_ip, latest(dest_nt_domain) as dest_nt_domain, latest(file_name) as file_name, latest(file_path) as file_path, latest(Publisher) as Publisher, latest(file_size_bytes) as file_size_bytes, latest(file_hash) as file_hash, latest(MD5) as MD5, latest("SHA-1") as "SHA-1", latest("SHA-256") as "SHA-256", latest(TrustValue) as TrustValue, latest(vendor_product) as vendor_product, latest(Bit9Server) as Bit9Server by _time ... View more

Did anyone ever get this working with DB Connect v2? I have had the same issue with no luck. ... View more

I have the same issue but it appears Splunk is not taking into consideration our hyper threaded cores. I thought running 6.3.x would fix this issue. ... View more

Did you ever figure out the answer to this? I am seeing the same errors appear on our servers. ... View more

It also took me a second to find the prebuilt panels as well. Are there any plans to build an app/dashboard out of these panels? I see there is a Bit9 app and it would be great if these panels were already included or vice versa. ... View more

Were you able to get this to work using transforms? I added the stanza below to my indexers and it is still not working properly. [force_index_for_nessus] REGEX = . DEST_KEY = _MetaData:Index FORMAT = vulnerability ... View more

If you add this stanza, everything in that spool directory will be sent to your index=security. Did you have to specify the nessus files in order to avoid that? [batch://$SPLUNK_HOME/var/spool/splunk/*.nessus] index = security ... View more

Have you had any luck? Thanks. ... View more

I am using the App sendresults. Below are the variables I am using. This will recurse through my results and email each manager their employee results. | eval email_to=manager | sendresults subject="Test." showemail=f ... View more