https://community.splunk.com/t5/Splunk-Enterprise-Security/CIM-and-Physical-Access-Control-Data-Model-ES/m-p/281655#M2312 <P>You're right. The existing DMs should be good enough for now. Re-using saves a few CPU cycles and a lot of memory. If I come into a situation that requires its own model I'll let you know. There may be card reader specifics but that's not really my field so I can't think of a case that requires a DM on its own </P> Mon, 19 Sep 2016 17:41:33 GMT mikaelbje 2016-09-19T17:41:33Z https://community.splunk.com/t5/Splunk-Enterprise-Security/CIM-and-Physical-Access-Control-Data-Model-ES/m-p/281653#M2310 <P>Hi,</P> <P>are there any plans to add a Physical Access Control Data Model to the CIM? I'm considering putting physical access control logs (card readers, door openers etc) in ES and would like to know if this is planned. Otherwise I'll have to create my own DM.</P> <P>Perhaps the Authentication DM could be extended, or create a new one called Access?</P> <P>Anyone doing this already?</P> Mon, 19 Sep 2016 10:23:21 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/CIM-and-Physical-Access-Control-Data-Model-ES/m-p/281653#M2310 mikaelbje 2016-09-19T10:23:21Z https://community.splunk.com/t5/Splunk-Enterprise-Security/CIM-and-Physical-Access-Control-Data-Model-ES/m-p/281654#M2311 <P>Hi Mikael,</P> <P>I'll start by asking what you need. There's two reasons for the information models: being able to find information, and being able to make high-speed, low-resolution decisions from the data. Examples:</P> <OL> <LI>I have twelve brands of card reader system and I want to look in the same field to find the friendly name of the protected location.</LI> <LI>I want to make a correlation search from accelerated fields that are specific to card readers.</LI> </OL> <P>I was trying to make up a card-reader specific correlation search that isn't just replication of an existing correlation search, but I'm not able to think of one. For instance, Brute Force or Impossible Access... tag the data as authentication and you're covered. Privilege escalation, tag the account management stuff... </P> Mon, 19 Sep 2016 16:26:26 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/CIM-and-Physical-Access-Control-Data-Model-ES/m-p/281654#M2311 jcoates_splunk 2016-09-19T16:26:26Z https://community.splunk.com/t5/Splunk-Enterprise-Security/CIM-and-Physical-Access-Control-Data-Model-ES/m-p/281655#M2312 <P>You're right. The existing DMs should be good enough for now. Re-using saves a few CPU cycles and a lot of memory. If I come into a situation that requires its own model I'll let you know. There may be card reader specifics but that's not really my field so I can't think of a case that requires a DM on its own </P> Mon, 19 Sep 2016 17:41:33 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/CIM-and-Physical-Access-Control-Data-Model-ES/m-p/281655#M2312 mikaelbje 2016-09-19T17:41:33Z https://community.splunk.com/t5/Splunk-Enterprise-Security/CIM-and-Physical-Access-Control-Data-Model-ES/m-p/281656#M2313 <P>We use Authentication Data Model, it makes it easy to correlate between door access and computer access. Just leverage the DVC or the SRC_host field to indicate the door name/id. </P> Tue, 04 Oct 2016 21:49:50 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/CIM-and-Physical-Access-Control-Data-Model-ES/m-p/281656#M2313 mcronkrite_splu 2016-10-04T21:49:50Z https://community.splunk.com/t5/Splunk-Enterprise-Security/CIM-and-Physical-Access-Control-Data-Model-ES/m-p/281657#M2314 <P>Yep,I ended up doing this and prefixing the src field with "Door_". Now I just need to populate all the asset lists. Blah!</P> <P>If anyone is interested in seeing an example implementation, it's available here: <A href="https://github.com/inspired/TA-Stanley-Access_Control">https://github.com/inspired/TA-Stanley-Access_Control</A></P> Wed, 05 Oct 2016 07:27:07 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/CIM-and-Physical-Access-Control-Data-Model-ES/m-p/281657#M2314 mikaelbje 2016-10-05T07:27:07Z