About mokuso

mokuso · ‎06-10-2020

I had a similar issue. The results of the above query only returned the "communicate" and "network" tags. It appears that the default/eventtypes.conf is ignoring "stream:Splunk_*" which excludes "stream:Splunk_DNS*" events: [stream_dns] search = sourcetype=stream:dns NOT source=stream:Splunk_* I added the following to local/eventtypes.conf and it resolved the issue: [stream_dns] search = sourcetype=stream:dns Now the dns events return all 4 tags: communicate, dns, network, resolution

mokuso · ‎05-18-2016

Hi Dave, The pvs app is due for an update. I'm planning to add several new dashboards and a dedicated index by default. Is there anything else you'd like to see for the next release?

mokuso · ‎05-15-2016

If you want to sort by severity and not total events, try this: index=pvs | chart count(eval(PVS_risk="CRITICAL")) AS CRITICAL , count(eval(PVS_risk="HIGH")) AS HIGH, count(eval(PVS_risk="MEDIUM")) AS MEDIUM, count(eval(PVS_risk="LOW")) AS LOW, count(eval(PVS_risk="INFO")) AS INFO, count(eval(PVS_risk="NONE")) AS NONE by src | sort 10 - CRITICAL,HIGH,MEDIUM,LOW,INFO

mokuso · ‎05-13-2016

I agree with @rich7177 and I would have expected the linemerge setting to fix your issue. Can you try adding both of the following to your props.conf: SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) regex101 is going to only return the first match unless you add the 'g' global modifier. https://regex101.com/r/dY6wN0/1

mokuso · ‎04-29-2016

You should use standard syslog. Current parsing doesn't support CEF.

mokuso · ‎12-08-2014

The dashboards should not rely on a specific index. I'll attempt to try and reproduce and see if I have a similar result. Is any data returned when you search for "eventtype=pvs"?

mokuso · ‎11-26-2014

The current version of the app is focused solely on the real-time events as the vulnerability results can be viewed natively in PVS. If there's interest we can look into adding support for this.

Posts	7
Solutions	2
Karma Given	0
Karma Received	3
Member Since	‎10-18-2011

Online Status	Offline
Date Last Visited	‎06-10-2020 03:06 PM

Re: How to make Stream logs CIM compliant

Re: How to replicate dashboards in the Tenable Net...

Re: How to replicate dashboards in the Tenable Net...

Re: Tenable Network Security PVS App for Splunk: H...

Re: Tenable Network Security PVS App for Splunk: S...

Re: PVS App Data Not Appearing in Dashboard After ...

Re: PVS App Not Parsing Vulnerabilities Correctly