Hi,

Currently, the software_version fails from being extracted for NX/OS devices, adding the following field alias in props.conf of your Cisco addon does the job:

[Cisco:SmartCallHome]

For NX/OS

FIELDALIAS-sch_fields-100 = "soap-env:Envelope.soap-env:Body.aml-block:Block.aml-block:Header.aml-block:Builder.aml-block:Version" AS software_version

According to your configuration, i have arbitrary choose a "sh_fields-100" name.

Thank you !

Guilhem

Remove dependency from ITSI/IT Essentials by creating a different macro used in default/data/ui/views/inventory_device.xml

Hello,

The default.xml for the application navigation menu will not show default Splunk interfaces for Reports, Alerts and Dashboards menus.

These are now Splunk standard since 6.x Splunk main version, is that possible to put back these menus by default ?

In:

default/data/ui/nav/default.xml

Adding:

<view name="reports" />
<view name="alerts" />
<view name="dashboards" />

Removing these menus introduces confusion for Splunk 6.x users that won't be able to find easily their own objects like custom dashboards or reports.

Thank you !

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf
Slide 36

Also tag them and contribute detections to https://github.com/splunk/security-content

Hi Guys,

Thanks a lot for your work! Very very useful!
But do you think to update the app to jQuery 3.5?
I saw that the app doesn't pass the jQuery 3.5 test on Splunk Cloud.

Thanks a lot!
Regards,
M.

Hi,

The "inventory_device" view references a lookup table called "Cisco_Device" which is not available anywhere in the App or the Addon.

cisco_ios/default/data/ui/views/inventory_device.xml

    <searchString>| inputlookup Cisco_Device | search host=$form.host$ | fields host | appendcols [search eventtype=cisco_ios-smart_call_home host=$form.host$ | rename hostname AS host | fields host | head 1]</searchString>

Splunk will return the following error as the lookup table does not exist: "The lookup table 'Cisco_Device' is invalid."

Is that expected ? Does this lookup table comes from an external App that should be installed ?
I couldn't find that in your docs.

Thank you.

Guilhem

Decided to drop it as it stinks