topic Re: Normalize action field values in Splunk Enterprise Security

Normalize action field values

splunkcol — Mon, 28 Dec 2020 14:41:27 GMT

I have an index called firewall and sourcetypes of Palo Alto, Checkpoint and Fortinet routers

The configuration was carried out according to the documentation recommendations regarding recommended sourcertype and Add-on according to the vendor

The "action" type fields that are accepted have different names depending on the brand of the device

Those that are accepted are:

allowed
accept
Authorize
pass

Taking into account that "accept" and "allowed" mean the same thing, should I normalize them? or as they are already recognized by the correlation events that Splunk ES has created?

Re: Normalize action field values

richgalloway — Mon, 28 Dec 2020 15:04:46 GMT

Splunk ES expects normalized field values as documented in the Common Information Model (CIM). The TAs for those sources should have normalized the fields for you, but if they did not (or you don't use TAs) then you'll have to do so.

Re: Normalize action field values

splunkcol — Mon, 28 Dec 2020 15:18:17 GMT

should I do it through aliases?

Re: Normalize action field values

richgalloway — Mon, 28 Dec 2020 21:53:51 GMT

Aliases create new fields with different names, but the same values so they won't help normalize values. Use eval.

EVAL action=if(action="accept" OR action="Authorize" OR action="pass", "allowed", action)

Re: Normalize action field values

splunkcol — Mon, 28 Dec 2020 15:39:01 GMT

@richgalloway Last question, what is the correct way to normalize it in this case?

Re: Normalize action field values

richgalloway — Mon, 28 Dec 2020 21:59:51 GMT

Like with many things Splunk,there is more than one way to do it. The "correct" one is the one that works for you.