Adding new data sources to InfoSec App

[pc1]

I have set up new data sources already in Splunk that bring in CIM compliant data (from sophos and cisco meraki). Is there a way that I can link them to the InfoSec App? I didn't originally set up the InfoSec app so I am unsure how data gets tied to it. Most documentation online is unhelpful for adding new data sources to the InfoSec App unless its one of the very few listed in the data onboarding guides in the Splunk Security Essentials app. Any help or references to actually helpful documentation on adding a new data source would be greatly appreciated. 

[solarboyz1 · Accepted solution]

If the InfoSec is similar to the ES app, you get the data in, by updating the searches used to generate the CIM data models.  The searches in the InfoSec app are then run against the data models. 

For example, the Intrusion Detection datamodel is using the following search to identify the events for the datamodel:

(`cim_Intrusion_Detection_indexes`) tag=ids tag=attack

As long as your data is getting parsed and tagged correctly, and the macro cim_Intrusion_Detection_indexes  includes your new indexes,  your data should be working with the default infosec searches. 

[pc1]

@solarboyz1 So, in order to link the data coming in to the InfoSec app, I should add the appropriate tags to correlate to which requirement I want it to fulfill? After adding the tags, the macro should recognize the new data, right? I will do some looking into adding tags - never done that before.

[solarboyz1]

Correct, for the data to get  into the datamodel, it has to match the constraints of the datamodel search. 

Additionally, you need to make sure your events contain the CIM compliant/required fields names/values.