Report from IPDB

[Anonymous]

Hello,

Somebody can help me retrieve events from IPDB located at RSA enVision ES? I read and do all what I find here: https://sadocs.emc.com/0_en-us/095_10.3_User_Guide/13_Device_and_Service_Configuration/IPDB_Extractor_Service_Configurat…

I retrieve devicelist, but can't rectrieve data (events). If I create simpe rule, for example "select ip.src, ip.dst" and "where event.cat.name like '%'" and event source - my devicelist - I receive blank report. I try written any terms in where field and all time I receive blank report.

[RSAAdmin]

Hi,

Can you show the rule that does work with ES? I connected ES+DAS but no luck with reports on IPDB data (DAS is not supported but can be used you just won't get rsa support on that)

[Anonymous]

SQL select in ENVISION:

EventCategoryName = 'User.Activity.Failed Logins' AND Process = 'NtLmSsp'

Return me 7 items.

How can see this select in SA?

Where: event.cat.name = 'User.Activity.Failed Logins' AND process = 'NtLmSsp'

Not return me result, I see "No Values Available For The Rule."

[huanzhou1]

Create IPDB Datasource Event Source List for Reports - RSA Security Analytics Documentation

The link above is working rule.

[huanzhou1]

what's your timezone settings? can you share your rule and rule testing screenshot?

[Anonymous]

I have IPDB datasource and devicelist:

[huanzhou1]

last issue i had also, i can get device list bt not able to events. but that one was with multiple storages.

can share your rule?

[Anonymous]

My timezone at appliance - UTC+4 (MSK), in UI - Profile -> Prefference -> Browser Time Zone: Europe/Moscow (GMT+04:00).

Rulу and result testsing attached.

[huanzhou1]

can you remove the where statment and see anything? or increase the time window?

[Anonymous]

This is not solve problem and give equal result.

[huanzhou1]

now i've no idea already. Have you openeed support?

I  had issue with multiple storage as well, case opened with support two weeks already but no solution.