Splunk Enterprise Security

Will the correlation that ES works off of with the Add-on cause issues in finding the data if I have version 5.0 in the environment and version 4.8.4 in ES?

Crashfry
Path Finder

I'm running into an issue with Enterprise Security (ES) - correlation with event types with Add-ons.

The example I have is with the Windows Add-on. I have version 5.0 in the environment but with ES I have version 4.8.4 - will the correlation that ES works off of with the Add-on cause issues in finding the data?

0 Karma
1 Solution

Crashfry
Path Finder

Answered my own question - it's important with the changes of tags and event types - specifically with this situation and the windows add-on.

View solution in original post

0 Karma

Crashfry
Path Finder

Answered my own question - it's important with the changes of tags and event types - specifically with this situation and the windows add-on.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!