Viewing Events in Splunk
The Search tab of the add-on allows for searching Splunk events created from the configured inputs. This can be used to confirm the inputs have been configured properly.
To view the events and detections imported by the FortiNDR Cloud app:
- In the Splunk Search tab, click Data Summary.
-
2. Click the Source or Sourcetypes tabs to view the event sources or source types, and the number (Count) of events that exist in Splunk for each source. If the inputs are created properly, these numbers should increase as data is pulled.
The available Sources for this add on are:
- fortindr_cloud_detections
- fortindr_cloud_events
- fortindr_cloud_entities
The available Source Types for this add on are:
- FortiNDRCloud:Detections
- FortiNDRCloud:Events
- FortiNDRCloud:Entities