All Apps and Add-ons

How do I get AD data type into Splunk UBA?

JK42
Explorer

We have all of our Windows Events from our domain controllers going into UBA with a CIM Compliant Splunk Direct data source however it is saying we are missing AD data. What is the requirement for AD data in UBA? Do we a need a particular app feeding into it?

0 Karma
1 Solution

JK42
Explorer

I recreated the data source with just index=windows instead of the CIM compliant tags.

View solution in original post

JK42
Explorer

I recreated the data source with just index=windows instead of the CIM compliant tags.

cmeisch
Path Finder

Anyone know why tags would not work?

0 Karma

ssattler
Path Finder

Does domain actually make a difference. the documentation is horrible, changes from 4.30 to 4.32 have not been updated in the documentation and in general just near useless, I am finding contact PS as the default answer.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Pls submit as a new question in splunk answers

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Did you discuss with your PS contact? when you say missing AD data, do you mean skipped events in UBA? where does it say missing AD data?

JK42
Explorer

When looking at the "Data Availability" screen it shows AD listed under no data available.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Ok. I am on UBA 4.3.x . System -> Data availability (Data views) should list 'AD' under 'data available' and link it to your 'Data sources' , models and anomaly types. What do you see in Manage -> Data Sources? Are you seeing your AD data with appropriate 'Name' and status /format as processing ? UBA can read the windows event logs natively without splunk direct.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>