Data Source: Cisco Network Visibility Module OSquery

Date: 2026-07-14

ID: d59bcd3c-da06-41c6-b33e-8b8d23078f68

Author: Nasreddine Bencherchali, Splunk

Description

Data source object for OSquery events from Cisco Network Visibility Module

Details

Property	Value
Source	`not_applicable`
Sourcetype	`cisco:nvm:osquery:v2`

Supported Apps

Cisco Security Cloud (version 4.0.0)

Event Fields

+ Fields

  <span class="pill kill-chain">current_page</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">fv</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">osquery_version</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">qid</span>
  
  <span class="pill kill-chain">qjr</span>
  
  <span class="pill kill-chain">qpi</span>
  
  <span class="pill kill-chain">qpn</span>
  
  <span class="pill kill-chain">qt</span>
  
  <span class="pill kill-chain">query_id</span>
  
  <span class="pill kill-chain">query_json_response</span>
  
  <span class="pill kill-chain">query_timestamp</span>
  
  <span class="pill kill-chain">qv</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">splunk_server_group</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">total_pages</span>
  
  <span class="pill kill-chain">udid</span>
  
</div>

Example Log

1{ "fv": "nvzFlow_v8", "udid": "D5E5634FDBEE82655C9C0E7523CDCE62A8249A1C", "qv": "5.5.1-dirty", "qid": "38654705666", "qt": "1784017742", "qpi": "1", "qpn": "1", "qjr": "[{\"active\":\"1\",\"autoupdate\":\"1\",\"identifier\":\"addons-search-detection@mozilla.com\",\"location\":\"app-builtin-addons\",\"name\":\"Add-ons Search Detection\",\"type\":\"extension\",\"uid\":\"1001\",\"version\":\"3.0.0\",\"visible\":\"1\"},{\"active\":\"1\",\"identifier\":\"formautofill@mozilla.org\",\"name\":\"Form Autofill\",\"version\":\"1.0.1\"}]"}

Required Output Fields

query_json_response

Source: GitHub | Version: 3