Splunk Enterprise Security

Why Splunk CIM does not apply tags but 'Search & Reporting' does?

DEAD_BEEF
Builder

Within Splunk ES, I have two tags applied based on Event types and cannot for the life of me get it to apply when attempting to validate the data model and the data. Of all things, the only field not working is the tag field. I even made an alias for tag, which I think is pointless since the original field is called tag already. Are there any suggestions besides admitting I have lost my sanity?

alt text

0 Karma
1 Solution

DEAD_BEEF
Builder

My two tags were not listed in the tag whitelist. Adding them there solved the problem. Add them under
ES > CIM Setup > Intrusion Detection and adding the two tags to the tags whitelist

View solution in original post

DEAD_BEEF
Builder

My two tags were not listed in the tag whitelist. Adding them there solved the problem. Add them under
ES > CIM Setup > Intrusion Detection and adding the two tags to the tags whitelist

View solution in original post


Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on