All Apps and Add-ons

How do I get AD data type into Splunk UBA?

JK42
Explorer

We have all of our Windows Events from our domain controllers going into UBA with a CIM Compliant Splunk Direct data source however it is saying we are missing AD data. What is the requirement for AD data in UBA? Do we a need a particular app feeding into it?

0 Karma
1 Solution

JK42
Explorer

I recreated the data source with just index=windows instead of the CIM compliant tags.

View solution in original post

JK42
Explorer

I recreated the data source with just index=windows instead of the CIM compliant tags.

cmeisch
Path Finder

Anyone know why tags would not work?

0 Karma

ssattler
Path Finder

Does domain actually make a difference. the documentation is horrible, changes from 4.30 to 4.32 have not been updated in the documentation and in general just near useless, I am finding contact PS as the default answer.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Pls submit as a new question in splunk answers

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Did you discuss with your PS contact? when you say missing AD data, do you mean skipped events in UBA? where does it say missing AD data?

JK42
Explorer

When looking at the "Data Availability" screen it shows AD listed under no data available.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Ok. I am on UBA 4.3.x . System -> Data availability (Data views) should list 'AD' under 'data available' and link it to your 'Data sources' , models and anomaly types. What do you see in Manage -> Data Sources? Are you seeing your AD data with appropriate 'Name' and status /format as processing ? UBA can read the windows event logs natively without splunk direct.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...