Nick von Korff, Author at Sourced Group

Posts by Nick von Korff

Data Model Wrangler: Tracking Splunk Data Model Compliance

Posted on August 24, 2022

Organisations with large Splunk deployments, especially those using Splunk Enterprise Security, understand the importance of having data sources properly mapped to the Splunk Common Information Model (CIM) data models. Poor CIM compliance yields poor security insights, as Splunk Enterprise Security utilises data model searches almost exclusively in its security use-case correlation searches. Something that has been […]

Gmail Audit Add-on for Splunk

Posted on July 16, 2019

As part of a cyber-security programme at one of our larger customers, there was a requirement to monitor email header data from one of the client’s subsidiary organisations. This data needed to be stored in the Splunk deployment of the parent organisation. While it sounds like a reasonably straightforward requirement, there were a lot of […]

Monitoring Microsoft Active Directory and DNS Instance Services with Datadog

Posted on June 4, 2018

On a recent client engagement I had the opportunity to develop Datadog dashboards to monitor a production Microsoft Active Directory deployment and expose vital metrics relating to service health and capacity. Building on basic monitoring of the core infrastructure running these AD/DNS instances, we dived deeper to collect and present service-specific metrics, service statuses and […]