Splunk Cloud InfoSec App

[djoherl]

Hello All,

I'm receiving a warning from our InfoSec app that my data isn't CIM compliant.  We have FortiGate syslogs, Windows Domain Controller Security logs, and Carbon Black Cloud logs being sent to Splunk Cloud.  

As far as I can tell, the logs being sent are CIM-compliant.  Is there anything else I can check?  

Thanks, Doug

[bharathkumarnec]

@djoherl all the necessary add-ons for the onboarded logsources are installed? Health check dashboard will give some information to start with...