- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have the InfoSec App installed, but I'm having trouble having the app read some of my data sources.
I’m sending data from a Cisco ASA by listening on a TCP port.
I’m sending security event log info from Active Directory via Remote event log connection in Data inputs.
They are both in separate indexes.
The data from both sources is searchable in Search and Reporting, and I can also see the ASA data in the Firegen Cisco App.
In the InfoSec app, I'm able to see some hits under Continous Monitoring > Windows Access Changes > Privelege Escalations. However, I don't see any hits for the rest of the counters (Successful/Failed Authentications).
The installation is a single Splunk instance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you only see Privileges Escalations report but not the rest of Windows reports on the Windows Access and Changes dashboard, that is likely because you either don't have the CIM Add-on installed or the Authentication data model in not accelerated.
- CIM Add-on: https://splunkbase.splunk.com/app/1621/
- Data model acceleration (must have rights to perform this operation): Settings>Data Models>Edit (for Authentication data model)>Edit Acceleration
The list of required add-ons and data models that need to be accelerated is in the prerequisites here: https://splunkbase.splunk.com/app/4240/#/details
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you only see Privileges Escalations report but not the rest of Windows reports on the Windows Access and Changes dashboard, that is likely because you either don't have the CIM Add-on installed or the Authentication data model in not accelerated.
- CIM Add-on: https://splunkbase.splunk.com/app/1621/
- Data model acceleration (must have rights to perform this operation): Settings>Data Models>Edit (for Authentication data model)>Edit Acceleration
The list of required add-ons and data models that need to be accelerated is in the prerequisites here: https://splunkbase.splunk.com/app/4240/#/details
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have the following acceleration settings enabled for the authentication data model in CIM:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The parameters for data model acceleration look good. Thanks for posting the details.
Are you using Windows Add-on to bring Windows data in? Do you have it installed on your Splunk server? If you don't, you'll need it to have the data model data populated properly.
If you do, do the following searches return any results?
index=* app="win*" action=success tag=authentication
index=* action=success tag=authentication
If the searches come back empty, that is likely a problem with the Windows Add-on configuration.
