topic Re: CIM data model for Azure activity logs in Splunk in Knowledge Management https://community.splunk.com/t5/Knowledge-Management/CIM-data-model-for-Azure-activity-logs-in-Splunk/m-p/492915#M4420 <P>This APP is not CIM compliant. You need to ask the creator, or associate yourself with CIM.<BR /> Good luck!</P> Mon, 07 Oct 2019 11:27:35 GMT HiroshiSatoh 2019-10-07T11:27:35Z CIM data model for Azure activity logs in Splunk https://community.splunk.com/t5/Knowledge-Management/CIM-data-model-for-Azure-activity-logs-in-Splunk/m-p/492914#M4419 <P>Hello,</P> <P>I have onboarded activity logs from an azure subcription to splunk using Azure monitor addon for splunk, <A href="https://splunkbase.splunk.com/app/3534/#/details">https://splunkbase.splunk.com/app/3534/#/details</A> , and the logs are parsed into below sourcetypes,</P> <P>amal:administrative<BR /> amal:serviceHealth<BR /> amal:resourceHealth<BR /> amal:security<BR /> amal:ascRecommendation<BR /> amal:ascAlert</P> <P>Is there a CIM model for these sourcetypes? If not, how should CIM compliance be validated?</P> Fri, 04 Oct 2019 09:02:15 GMT https://community.splunk.com/t5/Knowledge-Management/CIM-data-model-for-Azure-activity-logs-in-Splunk/m-p/492914#M4419 bsanjee 2019-10-04T09:02:15Z Re: CIM data model for Azure activity logs in Splunk https://community.splunk.com/t5/Knowledge-Management/CIM-data-model-for-Azure-activity-logs-in-Splunk/m-p/492915#M4420 <P>This APP is not CIM compliant. You need to ask the creator, or associate yourself with CIM.<BR /> Good luck!</P> Mon, 07 Oct 2019 11:27:35 GMT https://community.splunk.com/t5/Knowledge-Management/CIM-data-model-for-Azure-activity-logs-in-Splunk/m-p/492915#M4420 HiroshiSatoh 2019-10-07T11:27:35Z Re: CIM data model for Azure activity logs in Splunk https://community.splunk.com/t5/Knowledge-Management/CIM-data-model-for-Azure-activity-logs-in-Splunk/m-p/492916#M4421 <P>Take a look at these apps:<BR /> <A href="https://splunkbase.splunk.com/app/2968/">https://splunkbase.splunk.com/app/2968/</A><BR /> <A href="https://splunkbase.splunk.com/app/2962/">https://splunkbase.splunk.com/app/2962/</A></P> Wed, 27 Nov 2019 17:55:03 GMT https://community.splunk.com/t5/Knowledge-Management/CIM-data-model-for-Azure-activity-logs-in-Splunk/m-p/492916#M4421 ssadh_splunk 2019-11-27T17:55:03Z