Splunk Enterprise Security

Which Splunk for Enterprise Security Dashboard contains "databases" logs?

MinaMina
New Member

Hello,

In Splunk Enterprise Security ES, I'm looking for dashboards where I can see sql server and oracle databases logs.

According to http://docs.splunk.com/Documentation/ES/3.3.0/Install/Dashboards , I can't find the mapping of ES dashboard to the "databases" datamodel, even if this one exists in CIM datamodel http://docs.splunk.com/Documentation/CIM/4.2.0/User/Datastore

Do you have any idea ?

Thx,

0 Karma
1 Solution

koshyk
Super Champion

CIM is more generic data framework. Splunk Enterprise Security (ES) only implements the security aspect of CIM. So when you say "Oracle" database logs, Splunk ES considers only the security events within the database logs as relevant (eg. authentication, vulnerability etc..)

But of course, Splunk ES has a "Search" option (Search -> Search). That's a generic search on all your indexes (Permissions allowing). But that's same as Search App

View solution in original post

koshyk
Super Champion

CIM is more generic data framework. Splunk Enterprise Security (ES) only implements the security aspect of CIM. So when you say "Oracle" database logs, Splunk ES considers only the security events within the database logs as relevant (eg. authentication, vulnerability etc..)

But of course, Splunk ES has a "Search" option (Search -> Search). That's a generic search on all your indexes (Permissions allowing). But that's same as Search App

MinaMina
New Member

Thank you for your answer !

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...