All Apps and Add-ons

Graph Security API and Splunk Common Information Model

jwalzerpitt
Motivator

The document states, "Security alerts ingested through this add-on are mapped to the Splunk Common Information Model", but when I review the events, every event has the same event type - GraphSecurityAlert - and the same 15 tags assigned to each event.

Is there a need to create specific event types with associated tags to ensure this add-on is mapped to the Splunk Common Information Model, or is it OK to go with the defaults?

Thx

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!