Wastewater historians send a custom OT sourcetype. Splunk Security Essentials shows no matching content. What is the right next step?
Select an answer to reveal the explanation.
Short Explanation
Empty SSE is an honest answer: there is no canned OT historian pack. That is when engineering gets a build request, not when someone invents a fake OT CIM on the fly. Missing content is a signal, not a cover-up.
Full Explanation
When wastewater historians send a custom OT sourcetype and Splunk Security Essentials shows no matching content, the right next step is to treat the empty SSE result as a signal that a defense engineer must build new searches—not that the analyst should fake OT CIM. Empty catalog results are honest: there is often no canned OT historian pack. Missing content should become an engineering build request with clear detection goals, not a cover-up that invents models or deletes the sourcetype. Analysts assess; engineers author when the catalog is empty.
Inventing a fictional OT CIM model and mapping historian tags by hand in every analyst search fails by concept: ad-hoc fake models do not create supported SSE content and fracture portability. Force-enabling Windows ransomware detections against the historian sourcetype misapplies endpoint malware content to OT telemetry. Deleting the historian sourcetype so SSE coverage looks complete hides the gap instead of closing it with real detections.
Exam caveat: empty-SSE-for-custom-OT items expect an engineering build signal—not fictional CIM, Windows ransomware reuse, or deleting the source to greenwash coverage.
Operational check: capture the empty SSE result for the wastewater historian sourcetype, open a detection-engineering request with sample events and desired behaviors, keep the sourcetype onboarded for hunting, and avoid marking OT coverage complete until purpose-built searches exist.