All Apps and Add-ons

How do I get AD data type into Splunk UBA?

JK42
Explorer

We have all of our Windows Events from our domain controllers going into UBA with a CIM Compliant Splunk Direct data source however it is saying we are missing AD data. What is the requirement for AD data in UBA? Do we a need a particular app feeding into it?

0 Karma
1 Solution

JK42
Explorer

I recreated the data source with just index=windows instead of the CIM compliant tags.

View solution in original post

JK42
Explorer

I recreated the data source with just index=windows instead of the CIM compliant tags.

cmeisch
Path Finder

Anyone know why tags would not work?

0 Karma

ssattler
Path Finder

Does domain actually make a difference. the documentation is horrible, changes from 4.30 to 4.32 have not been updated in the documentation and in general just near useless, I am finding contact PS as the default answer.

0 Karma

lakshman239
Influencer

Pls submit as a new question in splunk answers

0 Karma

lakshman239
Influencer

Did you discuss with your PS contact? when you say missing AD data, do you mean skipped events in UBA? where does it say missing AD data?

JK42
Explorer

When looking at the "Data Availability" screen it shows AD listed under no data available.

0 Karma

lakshman239
Influencer

Ok. I am on UBA 4.3.x . System -> Data availability (Data views) should list 'AD' under 'data available' and link it to your 'Data sources' , models and anomaly types. What do you see in Manage -> Data Sources? Are you seeing your AD data with appropriate 'Name' and status /format as processing ? UBA can read the windows event logs natively without splunk direct.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...