topic Re: Splunk Add-on for Microsoft Cloud Services CIM mapping not enabled for all Sourcetypes in Splunk Enterprise Security

Splunk Add-on for Microsoft Cloud Services CIM mapping not enabled for all Sourcetypes

becksyboy — Mon, 10 Feb 2025 15:24:51 GMT

Hi,

We noticed for the Splunk Add-on for Microsoft Cloud Services that CIM mapping is not enabled for all the Sourcetypes.

https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/Sourcetypes/

In particular for the mscs:kql sourcetype we are ingesting Azure Network logs via sourcetype="mscs:kql" Type=AZFWNetworkRule.

I would have expected this Add On to have Network Datamodel CIM mapping included without having to do this ourselves (which we can if required).

Is this the best Add On to use (or is there a better option) if you want more CIM mapping coverage by default or have you had to do manual CIM mapping when using this TA?

thanks

Re: Splunk Add-on for Microsoft Cloud Services CIM mapping not enabled for all Sourcetypes

kiran_panchavat — Mon, 10 Feb 2025 16:28:09 GMT

@becksyboy

For more comprehensive CIM mapping coverage, you might need to perform manual CIM mapping. The Splunk Add-on Builder can help you map fields from your data events to the fields in any data model, including CIM data models.

Check this https://community.splunk.com/t5/Splunk-Enterprise/Azure-Firewall-Logs-Issue/m-p/703787

Re: Splunk Add-on for Microsoft Cloud Services CIM mapping not enabled for all Sourcetypes

marycordova — Mon, 10 Feb 2025 18:06:34 GMT

LOL/SOB

I really wish there was more compliance around CIM, especially for these TAs built by big industry types...

but yes...self-CIM

Re: Splunk Add-on for Microsoft Cloud Services CIM mapping not enabled for all Sourcetypes

becksyboy — Mon, 10 Feb 2025 19:53:52 GMT

I agree! 🙃 Oh well self service CIM it is.