topic Malware Operations CIM, catering for multiple engines and pattern types in Security https://community.splunk.com/t5/Security/Malware-Operations-CIM-catering-for-multiple-engines-and-pattern/m-p/128770#M3900 <P>Hi,</P> <P>I am currently adapting sourcetypes for Trend Micro Products to the the CIM, in order to use them with ES and the CIM app.</P> <P>The CIM caters for:</P> <UL> <LI>product </LI> <LI>vendor</LI> <LI>product_version</LI> <LI>signature_version</LI> </UL> <P>However, the products I deal with have multiple scanning engines as well as multiple pattern file types. I thus propose some new fields:</P> <UL> <LI>engine</LI> <LI>engine_version</LI> <LI>signature_type</LI> <LI>signature_version</LI> </UL> <P>Perhaps <EM>signature_version</EM> can then be created using an eval of the specified fields.</P> <P>Regards,<BR /> Stephan</P> Tue, 05 Nov 2013 14:00:23 GMT stephanbuys 2013-11-05T14:00:23Z Malware Operations CIM, catering for multiple engines and pattern types https://community.splunk.com/t5/Security/Malware-Operations-CIM-catering-for-multiple-engines-and-pattern/m-p/128770#M3900 <P>Hi,</P> <P>I am currently adapting sourcetypes for Trend Micro Products to the the CIM, in order to use them with ES and the CIM app.</P> <P>The CIM caters for:</P> <UL> <LI>product </LI> <LI>vendor</LI> <LI>product_version</LI> <LI>signature_version</LI> </UL> <P>However, the products I deal with have multiple scanning engines as well as multiple pattern file types. I thus propose some new fields:</P> <UL> <LI>engine</LI> <LI>engine_version</LI> <LI>signature_type</LI> <LI>signature_version</LI> </UL> <P>Perhaps <EM>signature_version</EM> can then be created using an eval of the specified fields.</P> <P>Regards,<BR /> Stephan</P> Tue, 05 Nov 2013 14:00:23 GMT https://community.splunk.com/t5/Security/Malware-Operations-CIM-catering-for-multiple-engines-and-pattern/m-p/128770#M3900 stephanbuys 2013-11-05T14:00:23Z Re: Malware Operations CIM, catering for multiple engines and pattern types https://community.splunk.com/t5/Security/Malware-Operations-CIM-catering-for-multiple-engines-and-pattern/m-p/128771#M3901 <P>Hi Stephan,</P> <P>good suggestions, we'll look into this for the future. In the meantime, you're probably best off treating each engine version as a different product type for simplicity's sake.</P> Tue, 05 Nov 2013 18:07:21 GMT https://community.splunk.com/t5/Security/Malware-Operations-CIM-catering-for-multiple-engines-and-pattern/m-p/128771#M3901 jcoates_splunk 2013-11-05T18:07:21Z