All Apps and Add-ons

Graph Security API and Splunk Common Information Model

Motivator

The document states, "Security alerts ingested through this add-on are mapped to the Splunk Common Information Model", but when I review the events, every event has the same event type - GraphSecurityAlert - and the same 15 tags assigned to each event.

Is there a need to create specific event types with associated tags to ensure this add-on is mapped to the Splunk Common Information Model, or is it OK to go with the defaults?

Thx

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!