ibm-security-intelligence / count-mvs Goto Github PK

Script ends up always with an error "IndexError: list index out of range". The last position in the countMVS.log is "DEBUG Domain for IP Windows-Client-xxxxx is []".
This error probably is related only to Log Sources where the Type is a Microsoft Workstation.
All Microsoft Workstation Log Sources have a prefix in their name. How can these be excluded?

Thx in advance

Hi guys,

thanks for the script.
I was using it last week and it worked as expected.
Unfortunately this script counts Windows Clients as MVS but following the Cloud Pak licensing information Clients and Workstations aren't MVS.
I think it is the problem of qradar as it doesn't differentiate between windows servers and clients but maybe you can add an information in on the README.

Best Regards