Additional Configuration for OMB¶

Please do not enable the '* Data Inventory' Data Models acceleration before configuring the macro settings below

Note: * see table below for list of Data Inventory datamodels

OMB Data Inventory Setup¶

OMB Data Inventory panels uses the Data Inventory datamodels included in the app and can be found under Settings > Data Models (under Knowledge). Run the following steps to setup the datamodels:

1. Set Index Macros: Each Data Set uses a macro in the base search to define which index to search events in. Navigate to Settings > Advanced Search (under Knowledge) and select "Search Macros". Set each '*_indexes' macro listed in "Compliance Essentials" to the relevant index e.g. (index=windows_events)

2. Choose which Datamodels to Accelerate:

   a. Navigate to Settings > Data Models (under Knowledge).

   b. Click Edit > Edit Acceleration under Actions for each "* Data Inventory" Datamodel

   c. Select "Accelerate" and select the Summary Range.

The speed of summary creation depends on the amount of events involved and the size of the summary range. You can track progress towards summary completion on the Data Models management page. Under the Data Inventory datamodel, expand its row, and review the information that appears under ACCELERATION.

For more information on Accelerated Data Models, view Splunk Docs

Add additional Sourcetypes to the "* Data Inventory" Data Models (Optional)¶

Custom Sourcetypes can be added to the Data Model by running the following steps:

Creating an Eventtype¶

1. Navigate to Settings > Eventtypes (under Knowledge)
2. Create a new eventtype
3. Set destination app to "compliance_essentials", add a name and the new sourcetype in the search string (e.g. sourcetype=wineventlog) and enter a tag (view the steps below on how to determine which tag to enter)

Linking an Eventtype to the "* Data Inventory" Data Models through Tags¶

1. Navigate to Settings > Data Models (under Knowledge) > OMB Data Inventory
2. Select the Dataset to link the eventtype to and copy the tag under "Constraints" (e.g. to add to Windows Security Logs, click Windows Security Logs under Vendor-Specific Data, and copying the tag VendorSpecific-winsec).
3. Add that tag to step 3 under "Creating an Eventtype"

List of Data Inventory datamodels and associated macros that ship with Compliance Essentials¶