Thanks for your post. Found it after an hour of googling. Splunk Community should really deprecate answers older than a certain version or keep them separate in a historical archive to prevent the majority of their user base on newer versions from endlessly searching for relevant answers. In our case, the issue was the same as what you described (silent install of the Windows Universal Forwarder using the /quiet flag). Here's what we did: 1. Create the following text file (replace the correct path for your Splunk UF install): C:\Program Files\SplunkUniversalForwarder\etc\system\local\user-seed.conf 2. Add the following text into the file: [user_info] USERNAME = admin PASSWORD = changeme 3. Restart Splunk Fowarder service (e.g. manually within services.msc console). 4. Once the service restarts, it will remove your user-seed.conf file and put a hashed version of your password (changeme in our case) into a passwd file in the path below. We don't really need to know this anymore, but if you were ever wondering why it was missing in the first place, now you have it. C:\Program Files\SplunkUniversalForwarder\etc\passwd   5. Now you can also change your password using the previously configured password using the command line below:                 cd 'C:\Program Files\SplunkUniversalForwarder\bin'                 .\splunk edit user admin -auth admin:changeme -password <new_strong_password>     ... View more

I  feel like this is something that should be explained somewhere in the app or on the splunkbase site using a large font and in red. It is very unclear that SSE is just a log logistics and framework helper app and not a security monitoring / alerting app itself. There are some hints when you start stepping through the process (like all the other suggested apps), but users who are new to Splunk and are trying to set up some security monitoring will spin their wheels for a while before realizing this.   Edit: I think that may have come off as an angry critique. I'd just like to point out that I appreciate the all effort that went into the SSE app. The comprehensive approach to security detection mapped to MITRE ATT&CK with sample searches removes months of effort from the work needed to make Splunk useful from a security monitoring perspective. ... View more

There are cases where Splunk Essentials is not able to find the data using the pre-configured Data Source Check queries. Are you saying that the solution to that is to replicate the whole application and make changes there? Maybe that's not exactly throwing the wheel away and starting all over again, but it seems pretty close. ... View more

Appreciate the detailed response. I think separating log files is the way to go. However, it looks like the add-on wants to assign sourcetypes to events by referencing separate logfiles in multiple monitor stanzas. I can separate the ESA logs into another file using a host-based filter, but that means that I may still have to do some regex processing on rsyslog to separate them further into individual file types. I feel like the approach this add-on is taking is a bit odd / restrictive. ... View more

I see this box.conf file with these configs already in /splunk/etc/apps/Splunk_TA_box/default/ on Splunk 7.3.3. Did your add-on work after this? ... View more

Can you provide instructions on how to fill this out for the Box add-on? ... View more

Can you point me to documentation which shows that this add-on pulls OneDrive and other O365 application activity logs? So far it looks like O365 management api data, which doesn't contain user activity information. ... View more