Splunk Enterprise Security

Why Splunk CIM does not apply tags but 'Search & Reporting' does?

DEAD_BEEF
Builder

Within Splunk ES, I have two tags applied based on Event types and cannot for the life of me get it to apply when attempting to validate the data model and the data. Of all things, the only field not working is the tag field. I even made an alias for tag, which I think is pointless since the original field is called tag already. Are there any suggestions besides admitting I have lost my sanity?

alt text

0 Karma
1 Solution

DEAD_BEEF
Builder

My two tags were not listed in the tag whitelist. Adding them there solved the problem. Add them under
ES > CIM Setup > Intrusion Detection and adding the two tags to the tags whitelist

View solution in original post

DEAD_BEEF
Builder

My two tags were not listed in the tag whitelist. Adding them there solved the problem. Add them under
ES > CIM Setup > Intrusion Detection and adding the two tags to the tags whitelist

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!