We are currently deploying the netspoke apps in our environment. We already have all of the events that are going to our casb indexed into splunk and we don't want to duplicate data.
We setup the Input Addon to only pull in Alert and Audit events. Netspoke seems to consider events "alerts" even if they don't trigger an alert in the netspoke administration console. Does anyone have experience with a query that we could use in the Input Addon to limit the Alert events to only the events that have triggered an alert in the CASB? Thanks guys.