All Apps and Add-ons

admonEventType="deleted" not tagged with 'change'

simonsigre
Path Finder

I have noted events such as

index=* sourcetype=ActiveDirectory admonEventType="deleted" OR admonEventType="updated"

Does not have an eventtype set that applies the appropriate tags to have it comply with

https://docs.splunk.com/Documentation/CIM/4.11.0/User/ChangeAnalysis

Even though this is flagged as being CIM compliant, would be great if these where added, or, the project Git repo be made available as to allow contributions

simonsigre
Path Finder

@shogan_splunk any updates on the GitHub access?

0 Karma

simonsigre
Path Finder

Thanks @shogan_splunk appreciate the update and look forward to getting access to repo .
Also, props (not a Splunk joke) to forum handle.

0 Karma

shogan_splunk
Splunk Employee
Splunk Employee

Simon,
I am working on a major update, with the main part using the kv store, along with other minor fixes/enhancements. I will split off a minor update to include the missing CIM tags as well as the planned minor fixes and Windows TA v5 + support.
As far as github, I will place it there and update this answer with a link.
Thanks for the feedback,
Steve

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...