Security

Why is InfoSec App Not Displaying Correct Active Directory Info?

dvincent13
New Member

I am currently monitoring AD account data using InfoSec. However, the number of accounts under the "Compliance" tab and the "Health" tab that are being monitored is not the correct number. Even the numbers presented don't agree with each other. 

My data on AD appears to be CIM compliant as the CIM_Authentication section under "Health" is green. Only pulling from the "main" index from source types WinEventLog and ActiveDirectory.  My data sources appear correct.

 

Any ideas why InfoSec would not display the proper amount of accounts in AD? Am I looking at this wrong?

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...