E2G Plant Asset Integrity Add-on

The E2G Plant Asset Integrity Add-on provides search-time CIM normalization and enrichment for authentication and audit data collected from the E2G Plant Asset Integrity application. Authentication events are normalized and enriched for the Splunk Authentication data model, while audit and user activity events are normalized and enriched for the Splunk Change data model. The add-on provides field mappings, derived fields, event types, tags, and search-time extractions to enrich E2G events and make supported data available to CIM-compatible searches, data models, and Splunk Enterprise Security content. The default configuration supports index=e2g with sourcetypes e2g_authentication and E2G-Audit. Data collection is handled separately using Splunk DB Connect.