All Apps and Add-ons

How do I get AD data type into Splunk UBA?

JK42
Explorer

We have all of our Windows Events from our domain controllers going into UBA with a CIM Compliant Splunk Direct data source however it is saying we are missing AD data. What is the requirement for AD data in UBA? Do we a need a particular app feeding into it?

0 Karma
1 Solution

JK42
Explorer

I recreated the data source with just index=windows instead of the CIM compliant tags.

View solution in original post

JK42
Explorer

I recreated the data source with just index=windows instead of the CIM compliant tags.

cmeisch
Path Finder

Anyone know why tags would not work?

0 Karma

ssattler
Path Finder

Does domain actually make a difference. the documentation is horrible, changes from 4.30 to 4.32 have not been updated in the documentation and in general just near useless, I am finding contact PS as the default answer.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Pls submit as a new question in splunk answers

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Did you discuss with your PS contact? when you say missing AD data, do you mean skipped events in UBA? where does it say missing AD data?

JK42
Explorer

When looking at the "Data Availability" screen it shows AD listed under no data available.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Ok. I am on UBA 4.3.x . System -> Data availability (Data views) should list 'AD' under 'data available' and link it to your 'Data sources' , models and anomaly types. What do you see in Manage -> Data Sources? Are you seeing your AD data with appropriate 'Name' and status /format as processing ? UBA can read the windows event logs natively without splunk direct.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...