The city onboarded a new school-district web proxy. Raw events appear in Search, but the Enterprise Security Web Security Domain dashboard stays empty. What should the analyst diagnose?
Select an answer to reveal the explanation.
Short Explanation
Empty dashboards with a full raw index are usually a labeling problem, not a licensing problem. The Web domain reads CIM-mapped Web-model fields; if the new proxy was never tagged, the chart has nothing to count. Map it—do not shop for more licenses.
Full Explanation
If the city onboarded a new school-district web proxy and raw events appear in Search but the Enterprise Security Web Security Domain dashboard stays empty, diagnose that the sourcetype is not CIM-mapped or tagged for the Web data model, so the dashboard has nothing normalized to display. Presence in raw search proves ingest succeeded; emptiness on the Security Domain dashboard proves missing tags, eventtypes, or field mappings from the proxy technical add-on.
Claiming the deployment must buy more Splunk licenses before any Security Domain dashboard can render proxy events confuses licensing with CIM readiness when events already index successfully. Claiming dashboards populate only after a risk notable is closed invents a false workflow dependency that blocks visibility unnecessarily. Claiming proxy events must age thirty days before Enterprise Security will chart them invents a delay that is not an Enterprise Security requirement.
Exam caveat: raw events visible while an ES dashboard stays empty points to a CIM mapping or tagging gap for that Security Domain.
Operational check: install or configure the proxy technical add-on, confirm Web data-model tags and fields on sample school-district events, accelerate if required, and refresh the Web Security Domain dashboard with a known allow or block URL.