Splunk Enterprise Security

Strategies for populating watchlist field in Assets and Identity Framework


Can anyone please share some best practise or your own preferred method for populating the watchlist field in the assets and identities lookup table in ES ?

We are currently using Sailpoint data to populate the identities lookup.

The only one reference i have got is someone using below logic by leveraging the ldapsearch command.

| eval watchlist=if((userAccountControl % 4)>=2,"true","")

Labels (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!