Splunk Enterprise Security

Does anyone see potential issues with only pulling asset data into Splunk Enterprise Security?

adnankhan5133
Communicator

The reason here being that the organization we're setting up Splunk ES for is in the process of centralizing 4 different Active Directories into a single centralized one (Azure AD). We're planning to wrap up our implementation of Splunk ES in a month, while the central AD implementation will be done in December. Does anyone see any concerns or issues with bringing in only asset data for now, and then waiting until December to introduce the identity data? I understand that we'll just miss out on contexts associated with users performing actions that result in notable events, but wondering if there will be any actual concerns that we need to take into account.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...