Splunk Enterprise

How to do splunk enterprise security integration with windows universal forwarder?

CkopitcK
Engager

hi...

how to do splunk integration with windows (which uses universal forwarder agent), so that it appears in the apps section of splunk enterprise security, because so far I can only integrate splunk with windows without involving splunk enterprise security apps, so I want to do splunk enterprise security integration with windows, and I will do a bruteforce test on those windows

Thank you

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One does not integrate a Universal Forwarder (UF) with Spunk Enterprise Security (ES).  The UF sends data to Splunk Enterprise to be indexed and ES reads that data.  The key is the data must be made CIM-compliant when onboarded.  CIM is Splunk's Common Information Model, which defines common field names for certain type of data.  A common set of names makes it much easier to correlate data from multiple sources.  ES relies heavily on CIM.

Once you have your data onboarded and CIM-compliant, it's time to enable datamodel accelerations (DMAs).  DMAs make for faster searching and are another feature used heavily by ES.  In ES, select Configuration->CIM Setup.  For each data model appropriate to your data, check the Accelerate box and enter an index name in the Indexes box then click Save.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

One does not integrate a Universal Forwarder (UF) with Spunk Enterprise Security (ES).  The UF sends data to Splunk Enterprise to be indexed and ES reads that data.  The key is the data must be made CIM-compliant when onboarded.  CIM is Splunk's Common Information Model, which defines common field names for certain type of data.  A common set of names makes it much easier to correlate data from multiple sources.  ES relies heavily on CIM.

Once you have your data onboarded and CIM-compliant, it's time to enable datamodel accelerations (DMAs).  DMAs make for faster searching and are another feature used heavily by ES.  In ES, select Configuration->CIM Setup.  For each data model appropriate to your data, check the Accelerate box and enter an index name in the Indexes box then click Save.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...