All Apps and Add-ons

Windows Security Operations Center: After installation, I see four systems identified on the "About" tab, but why don't I see any info in the login events tab or any others?

symnetwork
New Member

I'm new to Splunk. I just installed the WSOC app and I see four systems identified on the "About" tab, but I don't see any info in the login events tab nor any of the others? What am I missing? I am using universal forwarders on these systems.

0 Karma

bojanz
Communicator

Have you set macros required for searches to work, depending on which indexes the data is going into?
Go to Manage Apps, find Windows Security Operations Center and click on Set up.

In the setup you should define index(es) that the logs are going into, i.e:

index=windows

After that everything should work automatically, no additional actions are required.

Bojan

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...