topic What is the difference between CIM malware attacks and Operations? in Knowledge Management https://community.splunk.com/t5/Knowledge-Management/What-is-the-difference-between-CIM-malware-attacks-and/m-p/444165#M3932 <P>It corresponds to CIM, but there is a model that I do not understand well.<BR /> What is the CIM Malware Operation? Can you explain in detail?</P> Tue, 19 Mar 2019 10:15:39 GMT HiroshiSatoh 2019-03-19T10:15:39Z What is the difference between CIM malware attacks and Operations? https://community.splunk.com/t5/Knowledge-Management/What-is-the-difference-between-CIM-malware-attacks-and/m-p/444165#M3932 <P>It corresponds to CIM, but there is a model that I do not understand well.<BR /> What is the CIM Malware Operation? Can you explain in detail?</P> Tue, 19 Mar 2019 10:15:39 GMT https://community.splunk.com/t5/Knowledge-Management/What-is-the-difference-between-CIM-malware-attacks-and/m-p/444165#M3932 HiroshiSatoh 2019-03-19T10:15:39Z Re: What is the difference between CIM malware attacks and Operations? https://community.splunk.com/t5/Knowledge-Management/What-is-the-difference-between-CIM-malware-attacks-and/m-p/444166#M3933 <P>Malware operations is about events/activities relating to 'scan', 'AV updates', scan started, scan completed etc.. that are not related to detecting an attack [ e.g. virus/malware/threat detected - they usually have a signature]. These events are to have tags : Malware, Operations as per data models. </P> Tue, 19 Mar 2019 10:39:29 GMT https://community.splunk.com/t5/Knowledge-Management/What-is-the-difference-between-CIM-malware-attacks-and/m-p/444166#M3933 lakshman239 2019-03-19T10:39:29Z