Splunk Enterprise Security

Threat Activity in the ES app stopped to populate data

soumyasaha25
Contributor

i have recently upgraded SPlunk from 7.1.1 to 7.3.4 and ES from 5.2.2 to 5.3.1, but after the upgrade i can see that the threat activity dashboard does not show any data (data is only available till the time splunk was upgraded)
i can see that the Threat Intelligence Data Model is enabled and accelerated, but when i see "Data Model Audit" it still shows the date and time of the last time for which the dashboard shows data.
Also, i can see that the datamodels Web and network traffic do report data (there are the dependant data models for Threat intelligence data model)
Since its on my prod system, i have not yet tried to rebuild the data model, wanted to know if there is any other possible fix for this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...