Splunk Enterprise

How to do splunk enterprise security integration with windows universal forwarder?

CkopitcK
Engager

hi...

how to do splunk integration with windows (which uses universal forwarder agent), so that it appears in the apps section of splunk enterprise security, because so far I can only integrate splunk with windows without involving splunk enterprise security apps, so I want to do splunk enterprise security integration with windows, and I will do a bruteforce test on those windows

Thank you

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One does not integrate a Universal Forwarder (UF) with Spunk Enterprise Security (ES).  The UF sends data to Splunk Enterprise to be indexed and ES reads that data.  The key is the data must be made CIM-compliant when onboarded.  CIM is Splunk's Common Information Model, which defines common field names for certain type of data.  A common set of names makes it much easier to correlate data from multiple sources.  ES relies heavily on CIM.

Once you have your data onboarded and CIM-compliant, it's time to enable datamodel accelerations (DMAs).  DMAs make for faster searching and are another feature used heavily by ES.  In ES, select Configuration->CIM Setup.  For each data model appropriate to your data, check the Accelerate box and enter an index name in the Indexes box then click Save.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

One does not integrate a Universal Forwarder (UF) with Spunk Enterprise Security (ES).  The UF sends data to Splunk Enterprise to be indexed and ES reads that data.  The key is the data must be made CIM-compliant when onboarded.  CIM is Splunk's Common Information Model, which defines common field names for certain type of data.  A common set of names makes it much easier to correlate data from multiple sources.  ES relies heavily on CIM.

Once you have your data onboarded and CIM-compliant, it's time to enable datamodel accelerations (DMAs).  DMAs make for faster searching and are another feature used heavily by ES.  In ES, select Configuration->CIM Setup.  For each data model appropriate to your data, check the Accelerate box and enter an index name in the Indexes box then click Save.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...