topic How to find out which data model a particular app maps to? in Splunk Enterprise Security

How to find out which data model a particular app maps to?

tmkunte — Thu, 10 Feb 2022 01:21:27 GMT

How do I find out which data model a particular app "maps" to?

Specifically the Cisco security suite ...

I see it is CIM compatible and need to get that data into my SIEM

Re: data model - app mapping

ryanoconnor — Thu, 09 Jun 2016 15:33:40 GMT

The Cisco Security Suite App https://splunkbase.splunk.com/app/525/ searches data from a number of different cisco devices. Many of those devices have their own individual Technology Add-ons.

Those specific technology add-ons are what you're going to want to look at. They will have tags that determine which data model the data is going to go into. The Splunk Add-on for Cisco ASA is a great example. https://splunkbase.splunk.com/app/1620/

For more information on which tags go to which data models you can look at specific data models here: http://docs.splunk.com/Documentation/CIM/latest/User/Overview

Re: data model - app mapping

nvonkorff — Wed, 09 Feb 2022 03:24:23 GMT

Hi @tmkunte

I recently wrote an app (Data model wrangler) that helps with identifying indexes and sourcetypes that are mapped to data models and calculates two scores to determine an overall health-check of mapping:

Mapping quality - Percent of recommended fields in the data model that are found in each index/sourcetype
Data quality - Percent coverage of each field within the data, e.g. 25% of events have the 'src' field present

It also provides a field-level view of mapped data to determine which fields are present/missing and which fields have a low data quality.

This may help to give a better understanding of what is mapped to each data model. It is also useful when trying to map custom sourcetypes to data models.