FISMA Audit Index

seanp — Mon, 28 Sep 2020 12:10:07 GMT

I am trying to configure the FISMA application on a Splunk 4.3 installation using Windows. Specifically I am configuring the Audit Component on the Overview page as all three show No Results Found. When I view the FISMA_SG_audit_event index, it is shows an event count of 0. Does anyone know what audit logs this is coming from? Do I need to add something to the input.conf file or WMI.conf file? I am currently collecting the Application, Security, and System logs on the DCs via the Universal Forwarder.

Thanks

Re: FISMA Audit Index

piebob — Mon, 30 Jul 2012 17:42:44 GMT

if you're talking about the "Splunk for Fisma" app (http://splunk-base.splunk.com/apps/44883/splunk-for-fisma) the Splunkbase page for the app says
"This app does not provide data inputs, extractions, or tags itself." and goes on to explain that you need to configure inputs yourself via other technology add-ons and ensure the data conforms to the Splunk Common Information Model.

topic FISMA Audit Index in Monitoring Splunk

FISMA Audit Index

Re: FISMA Audit Index