All Apps and Add-ons

How do I get AD data type into Splunk UBA?

JK42
Explorer

We have all of our Windows Events from our domain controllers going into UBA with a CIM Compliant Splunk Direct data source however it is saying we are missing AD data. What is the requirement for AD data in UBA? Do we a need a particular app feeding into it?

0 Karma
1 Solution

JK42
Explorer

I recreated the data source with just index=windows instead of the CIM compliant tags.

View solution in original post

JK42
Explorer

I recreated the data source with just index=windows instead of the CIM compliant tags.

cmeisch
Path Finder

Anyone know why tags would not work?

0 Karma

ssattler
Path Finder

Does domain actually make a difference. the documentation is horrible, changes from 4.30 to 4.32 have not been updated in the documentation and in general just near useless, I am finding contact PS as the default answer.

0 Karma

lakshman239
Influencer

Pls submit as a new question in splunk answers

0 Karma

lakshman239
Influencer

Did you discuss with your PS contact? when you say missing AD data, do you mean skipped events in UBA? where does it say missing AD data?

JK42
Explorer

When looking at the "Data Availability" screen it shows AD listed under no data available.

0 Karma

lakshman239
Influencer

Ok. I am on UBA 4.3.x . System -> Data availability (Data views) should list 'AD' under 'data available' and link it to your 'Data sources' , models and anomaly types. What do you see in Manage -> Data Sources? Are you seeing your AD data with appropriate 'Name' and status /format as processing ? UBA can read the windows event logs natively without splunk direct.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...