At my current position, I took over for someone who didn't take care of Splunk & Enterprise Security.
It looked as if it was never configured fully (Just ran through the little beginning wizard and left it).
I've gotten familiar with making my way around Enterprise Security. But there are some items that were being detected that aren't anymore! It's only detecting inactive accounts. It used to detect much more before I upgraded Splunk Enterprise Security.
After installation, what should be configured? I installed the Security Essentials app and ran through the Data inventory check, it detected some things. How do I tell Enterprise Security to look at those indexes?
I'm guessing I need to configure the CIM app? I don't know what are my next steps.
