Splunk Enterprise

How do I config to integrate incidents

Learner06
New Member

I have a question about Add-on settings. I want to import incident information created on CMC. In the Configuration tab, which data should I configure to be imported? Also, could you provide documentation on the types of information that can be obtained from the current options (Node, Link, Session, Asset, Node Cve, Alert, Health Log, Audit Log, Variable)?

Labels (2)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @Learner06 

I would recommend checking out the Nozomi docs at https://technicaldocs.nozominetworks.com/products/n2os/topics/sdk/data-model/r_n2os-sdk_data_model_a... for what data is available for these different entities.

For further information, assistance, or feedback, please contact Nozomi Networks support at https://support.nozominetworks.com

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...