Splunk Enterprise Security
Highlighted

How do I put my DLP events into the Alerts data model in Splunk Enterprise Security?

Hey Everyone,

I'm working on putting some of my DLP events into the Alerts data model. However, I'm struggling to find out where they actually populate in Splunk Enterprise Security. Is there a spot for these alerts in ES? I was hoping they would populate in the identity or asset investigator.

Thanks!

Highlighted

Re: How do I put my DLP events into the Alerts data model in Splunk Enterprise Security?

Contributor

A DLP alert is more akin to an intrusion detection alert. Except the opposite direction.

I would clone the Intrusion Detection data model, and call it DLP.
Then map the fields to CIM model. CIM_IntrusionDetection

0 Karma
Highlighted

Re: How do I put my DLP events into the Alerts data model in Splunk Enterprise Security?

Thanks MCronkrite!

I'm not sure if Splunk totally changed my topic, but my question direction was changed.

I reviewed the other DLP add-ons that Splunk has created and supported, more in particular the RSA DLP application (https://splunkbase.splunk.com/app/2956/) and they all look to be using the alerts data model for DLP. They state in the description that it's good for use in Splunk applications, including ES.

So I mocked up my DLP machine data to comply with that data model and I'm wondering where should it populate in ES? Is there a swimlane that it should go to?

Thanks!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.