Category: Problem | Priority: Normal |
|---|---|
Platform: Splunk | Version: 1 from 08.11.2022 |
Description
The Certificates.SSL CIM dataset does not return STRUST data as expected. Instead, the STRUST data will only appear when calling from the broader Certificates data model, and no SSL-related fields are found in the search results.
Cause
The applicable tag is missing from the STRUST event type, excluding the data from the SSL dataset.
Resolution
Add the “ssl” tag to the event type with the following procedure:
Go to Settings > Event types
Search for the “event_type_STRUST” event type
Click on the event type
Add the “ssl” tag next to the “certificate” tag
Save
After a few minutes, try searching again
