topic Re: CIM mapping CrowdStrike Falcon FileVantage (FIM) logs to a daamodel. in Getting Data In

CIM mapping CrowdStrike Falcon FileVantage (FIM) logs to a daamodel.

becksyboy — Wed, 23 Apr 2025 09:58:22 GMT

Hi All,

Has anyone managed to map CrowdStrike Falcon FileVantage (FIM) logs to a Datamodel; if so could you share your field mappings? We were looking at he Change DM, would this be the best option?

thanks

Re: CIM mapping CrowdStrike Falcon FileVantage (FIM) logs to a daamodel.

gcusello — Wed, 23 Apr 2025 12:01:43 GMT

hi @becksyboy ,

are you using the CrowdStrike Falcon FileVantage Technical Add-On ( https://splunkbase.splunk.com/app/7090 )?

if yes, this add-on should be already CIM compliant, but it isn.t true because in the add-on there isn't tags.conf and eventtypes.conf.

Anyway, I usually use to normalize data the SA-CIM_vladiator app ( https://splunkbase.splunk.com/app/2968 ) , that guides you in the normalization activity.

Ciao.

Giuseppe

Re: CIM mapping CrowdStrike Falcon FileVantage (FIM) logs to a daamodel.

becksyboy — Wed, 23 Apr 2025 12:23:20 GMT

Hi @gcusello yep we noticed the TA did not do CIM mapping 😶

In terms of FIM monitoring would you say the Change DM is the best fit, seems like it to me.

Re: CIM mapping CrowdStrike Falcon FileVantage (FIM) logs to a daamodel.

gcusello — Wed, 23 Apr 2025 12:28:48 GMT

Hi @becksyboy ,

yes probably the Change DM is the best fit, but probably also the Authentication DM is useful, it depends on your Use Cases.

Ciao.

Giuseppe