Join the Conversation
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: How do I get AD data type into Splunk UBA?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have all of our Windows Events from our domain controllers going into UBA with a CIM Compliant Splunk Direct data source however it is saying we are missing AD data. What is the requirement for AD data in UBA? Do we a need a particular app feeding into it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I recreated the data source with just index=windows instead of the CIM compliant tags.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I recreated the data source with just index=windows instead of the CIM compliant tags.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Anyone know why tags would not work?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does domain actually make a difference. the documentation is horrible, changes from 4.30 to 4.32 have not been updated in the documentation and in general just near useless, I am finding contact PS as the default answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Pls submit as a new question in splunk answers
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you discuss with your PS contact? when you say missing AD data, do you mean skipped events in UBA? where does it say missing AD data?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When looking at the "Data Availability" screen it shows AD listed under no data available.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok. I am on UBA 4.3.x . System -> Data availability (Data views) should list 'AD' under 'data available' and link it to your 'Data sources' , models and anomaly types. What do you see in Manage -> Data Sources? Are you seeing your AD data with appropriate 'Name' and status /format as processing ? UBA can read the windows event logs natively without splunk direct.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Break the Build: Inside the KubeDoom Lounge at .conf26
Splunk Auto Ingestion Parallel Pipeline Scaling
Best Practices: Splunk auto adjust pipeline queue
