Which Splunk for Enterprise Security Dashboard contains "databases" logs?

[MinaMina]

Hello,

In Splunk Enterprise Security ES, I'm looking for dashboards where I can see sql server and oracle databases logs.

According to http://docs.splunk.com/Documentation/ES/3.3.0/Install/Dashboards , I can't find the mapping of ES dashboard to the "databases" datamodel, even if this one exists in CIM datamodel http://docs.splunk.com/Documentation/CIM/4.2.0/User/Datastore

Do you have any idea ?

Thx,

[koshyk · Accepted solution]

CIM is more generic data framework. Splunk Enterprise Security (ES) only implements the security aspect of CIM. So when you say "Oracle" database logs, Splunk ES considers only the security events within the database logs as relevant (eg. authentication, vulnerability etc..)

But of course, Splunk ES has a "Search" option (Search -> Search). That's a generic search on all your indexes (Permissions allowing). But that's same as Search App

[MinaMina]

Thank you for your answer !