https://community.splunk.com/t5/Splunk-Enterprise-Security/Endpoint-datamodel/m-p/559001#M10050 <P>Hi,</P><P>For "Endpoint datamodel" with specific to "sysmon" sourcetype, what are all the mandatory fields?</P><P>&nbsp;</P><P>&nbsp;</P> Mon, 12 Jul 2021 01:04:39 GMT VijaySrrie 2021-07-12T01:04:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Endpoint-datamodel/m-p/559001#M10050 <P>Hi,</P><P>For "Endpoint datamodel" with specific to "sysmon" sourcetype, what are all the mandatory fields?</P><P>&nbsp;</P><P>&nbsp;</P> Mon, 12 Jul 2021 01:04:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Endpoint-datamodel/m-p/559001#M10050 VijaySrrie 2021-07-12T01:04:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Endpoint-datamodel/m-p/559002#M10051 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/164779">@VijaySrrie</a>&nbsp;</P><P><A href="https://splunkbase.splunk.com/app/1914/#/details" target="_blank">Splunk Add-On for Microsoft Sysmon | Splunkbase</A>&nbsp;Add-on having CIM mapping for sysmon data, you can find out the extractions by downloading it.</P><P>---</P><P>An upvote would be appreciated and Accept solution if it helps!</P> Mon, 12 Jul 2021 01:31:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Endpoint-datamodel/m-p/559002#M10051 venkatasri 2021-07-12T01:31:38Z