Why are most of my Ent. Security Dashboards are blank? How do I open the flood gates of data or events into ES

[SamHTexas]

Why are most of my Ent. Security Dashboards are blank? How do I open the flood gates of data or events into ES. Matter what options I pick or which dashboard, says no result  found. We have a large environment, where are the events & all the goods & incidents?

[richgalloway]

Many ES dashboards are populated by datamodels.  Have you set yours up?  Have you enabled correlation searches appropriate for your data?  Most importantly, is your data CIM-compliant?

[SamHTexas]

Thank u for your message. Yes, most of the environment was set up before I started. There are 30 or so datamodels mapped to apps & few 1000 saved searches. But the dashboards all pretty much say no data available!! Please advise. Also advise on how to best use the data models I have. Thank u

[richgalloway]

There is no easy answer for this problem.  I suspect data was not onboarded to be CIM-compliant so now it can't be found by the datamodels. 

Review an empty dashboard to see what it is trying to find.  Verify there is data meeting those requirements (same sourcetype, tags, fields, etc).  Add fields, aliases, and tags as necessary for the search to find the data.  Avoid modifying the built-in datamodels.

Repeat for each empty panel.

[SamHTexas]

Great, it is making a lot of sense. So what role do Lookup tables make in this picture?

[richgalloway]

Lookups enrich data.  In ES, they add asset and identity information to notable events in addition to whatever custom enrichments your searches may need.

I doubt lookups are a cause of your blank dashboards, however.  If the lookups were failing then you'd still see *something* on the dashboard.