Splunk Enterprise Security

Threat Intelligence Searches Not Populating threat_activity Index

Path Finder

The search "Threat - Source and Destination Matches - Threat Gen" is working and producing results, only the results aren't ending up in the threat_activity index where I would expect them to be. Does anyone know the dependencies I should be checking to ensure those events eventually end up in the Threat Activity dashboard?

0 Karma