How do I get AD data type into Splunk UBA?

[JK42]

We have all of our Windows Events from our domain controllers going into UBA with a CIM Compliant Splunk Direct data source however it is saying we are missing AD data. What is the requirement for AD data in UBA? Do we a need a particular app feeding into it?

[JK42 · Accepted solution]

I recreated the data source with just index=windows instead of the CIM compliant tags.

[cmeisch]

Anyone know why tags would not work?

[ssattler]

Does domain actually make a difference. the documentation is horrible, changes from 4.30 to 4.32 have not been updated in the documentation and in general just near useless, I am finding contact PS as the default answer.

[lakshman239]

Pls submit as a new question in splunk answers

[lakshman239]

Did you discuss with your PS contact? when you say missing AD data, do you mean skipped events in UBA? where does it say missing AD data?

[JK42]

When looking at the "Data Availability" screen it shows AD listed under no data available.

[lakshman239]

Ok. I am on UBA 4.3.x . System -> Data availability (Data views) should list 'AD' under 'data available' and link it to your 'Data sources' , models and anomaly types. What do you see in Manage -> Data Sources? Are you seeing your AD data with appropriate 'Name' and status /format as processing ? UBA can read the windows event logs natively without splunk direct.