How to do splunk enterprise security integration with windows universal forwarder?

[CkopitcK]

hi...

how to do splunk integration with windows (which uses universal forwarder agent), so that it appears in the apps section of splunk enterprise security, because so far I can only integrate splunk with windows without involving splunk enterprise security apps, so I want to do splunk enterprise security integration with windows, and I will do a bruteforce test on those windows

Thank you

[richgalloway · Accepted solution]

One does not integrate a Universal Forwarder (UF) with Spunk Enterprise Security (ES).  The UF sends data to Splunk Enterprise to be indexed and ES reads that data.  The key is the data must be made CIM-compliant when onboarded.  CIM is Splunk's Common Information Model, which defines common field names for certain type of data.  A common set of names makes it much easier to correlate data from multiple sources.  ES relies heavily on CIM.

Once you have your data onboarded and CIM-compliant, it's time to enable datamodel accelerations (DMAs).  DMAs make for faster searching and are another feature used heavily by ES.  In ES, select Configuration->CIM Setup.  For each data model appropriate to your data, check the Accelerate box and enter an index name in the Indexes box then click Save.