The city onboarded a new school-district web proxy. Raw events appear in Search, but the Enterprise Security Web Security Domain dashboard stays empty. What should the analyst diagnose?
Select an answer to reveal the explanation.
Short Explanation
Empty dashboards with a full raw index are usually a labeling problem, not a licensing problem. The Web domain reads CIM-mapped Web-model fields; if the new proxy was never tagged, the chart has nothing to count. Map it—do not shop for more licenses.
Full Explanation
ES Security Domain dashboards query accelerated CIM data models, not raw unmapped events. When a sourcetype is onboarded but not mapped and tagged to the Web model, Search still works while the Web dashboard stays empty. The fix is CIM compliance through mappings and tags, not additional licenses, notable-closure gates, or an aging delay. Treat that pattern as a mapping gap.