topic Re: EnterpriseSecurity - DataModels in Splunk Enterprise Security

EnterpriseSecurity - DataModels

astatrial — Wed, 02 Sep 2020 14:14:12 GMT

Hi everyone,

Introduction:

We have Palo Alto products, and we have also installed the appropriate add-on and apps. We mapped the data into the data models and the relevant data model for my question is the Web data model .

There is a field called dest in the DM, and for datamodel web (for palo alto) i need its value to be "dest_hostname" (the current value is "dest_ip"). The current value is relevant for the Network Traffic DM, therefore i don't want to change it.

Question:

Is it OK to add additional fields to the built-in data models of Splunk ES, or is it not recommended?

What are the downsides of action like this?

Thanks !

Re: EnterpriseSecurity - DataModels

richgalloway — Wed, 02 Sep 2020 15:24:11 GMT

Don't add fields to a DM unless absolutely necessary. In your case, you should be able to add the dest field by creating a new field alias that maps dest_ip to dest.

Re: EnterpriseSecurity - DataModels

astatrial — Thu, 03 Sep 2020 07:20:19 GMT

Hi @richgalloway ,

Thanks for the fast reply.

It is a bit problematic, as there is already a mapping from dest_ip to dest which is relevant for the "Network Traffic" data model. I need the dest in Web data model to contain values from dest_hostname and not dest IP (for palo alto).