topic How do I put my DLP events into the Alerts data model in Splunk Enterprise Security? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/How-do-I-put-my-DLP-events-into-the-Alerts-data-model-in-Splunk/m-p/272793#M2141 <P>Hey Everyone,</P> <P>I'm working on putting some of my DLP events into the Alerts data model. However, I'm struggling to find out where they actually populate in Splunk Enterprise Security. Is there a spot for these alerts in ES? I was hoping they would populate in the identity or asset investigator.</P> <P>Thanks!</P> Tue, 15 Dec 2015 19:23:08 GMT matthew_jochym 2015-12-15T19:23:08Z How do I put my DLP events into the Alerts data model in Splunk Enterprise Security? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-do-I-put-my-DLP-events-into-the-Alerts-data-model-in-Splunk/m-p/272793#M2141 <P>Hey Everyone,</P> <P>I'm working on putting some of my DLP events into the Alerts data model. However, I'm struggling to find out where they actually populate in Splunk Enterprise Security. Is there a spot for these alerts in ES? I was hoping they would populate in the identity or asset investigator.</P> <P>Thanks!</P> Tue, 15 Dec 2015 19:23:08 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-do-I-put-my-DLP-events-into-the-Alerts-data-model-in-Splunk/m-p/272793#M2141 matthew_jochym 2015-12-15T19:23:08Z Re: How do I put my DLP events into the Alerts data model in Splunk Enterprise Security? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-do-I-put-my-DLP-events-into-the-Alerts-data-model-in-Splunk/m-p/272794#M2142 <P>A DLP alert is more akin to an intrusion detection alert. Except the opposite direction. </P> <P>I would clone the Intrusion Detection data model, and call it DLP.<BR /> Then map the fields to CIM model. <A href="http://docs.splunk.com/Documentation/CIM/4.3.1/User/IntrusionDetection">CIM_IntrusionDetection</A></P> Tue, 15 Dec 2015 19:43:55 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-do-I-put-my-DLP-events-into-the-Alerts-data-model-in-Splunk/m-p/272794#M2142 mcronkrite 2015-12-15T19:43:55Z Re: How do I put my DLP events into the Alerts data model in Splunk Enterprise Security? https://community.splunk.com/t5/Splunk-Enterprise-Security/How-do-I-put-my-DLP-events-into-the-Alerts-data-model-in-Splunk/m-p/272795#M2143 <P>Thanks MCronkrite!</P> <P>I'm not sure if Splunk totally changed my topic, but my question direction was changed. </P> <P>I reviewed the other DLP add-ons that Splunk has created and supported, more in particular the RSA DLP application (<A href="https://splunkbase.splunk.com/app/2956/">https://splunkbase.splunk.com/app/2956/</A>) and they all look to be using the alerts data model for DLP. They state in the description that it's good for use in Splunk applications, including ES. </P> <P>So I mocked up my DLP machine data to comply with that data model and I'm wondering where should it populate in ES? Is there a swimlane that it should go to?</P> <P>Thanks!</P> Tue, 15 Dec 2015 19:56:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-do-I-put-my-DLP-events-into-the-Alerts-data-model-in-Splunk/m-p/272795#M2143 matthew_jochym 2015-12-15T19:56:38Z