CIM malware actions

richardphung — Tue, 20 Aug 2019 18:50:54 GMT

Greetings...
We are currently using ES and ingesting data from our IDS and AV to populate the Malware DataModel.

According to the documentation:
https://docs.splunk.com/Documentation/CIM/4.13.0/User/Malware

Dataset name: Malware_Attacks Field
name: action

Data type: string

Description: The action taken by the reporting device.
Abbreviated list of example values:
ES expects: allowed
Other: blocked, deferred

In our DataModel, we have an Eval Expression that uses a CSV inputlookup:
| inputlookup actions_te.csv

Which is not always helpful as there are a LOT of events being picked up by "deferred"

Would it still be CIM compliant if we evaled Redirect and Detect events as their own actions?
Would this break anything in ES?

Thanks in advance.

Re: CIM malware actions

lakshman239 — Thu, 22 Aug 2019 09:17:50 GMT

My suggestion is that you map your field values to one of - allowed/blocked/deferred for CIM complaince. this way the Security Domain -> Malware Center/Search/Operations dashboard will all be fine.

Any searches using datamodel/tstats should also be fine.

topic CIM malware actions in Splunk Enterprise Security

CIM malware actions

Re: CIM malware actions