All Apps and Add-ons

CIM definition for dest_host and dest_name is missing

Path Finder

I was reading the CIM Network Traffic data model definition and found this in the description of the dest field:

The destination of the network traffic (the remote host). You can alias this from more specific fields, such as dest_host, dest_ip, or    dest_name.

The fields dest_host and dest_name are used throughout the models, but are never actually defined anywhere. Are they the same thing, or different things? Can NetBIOS names be used, or only DNS FQDNs? Is the reverse DNS resolution of the destination IP address by a firewall accepted, or only the actual domain that was resolved by the endpoint to perform that network communication?

Without clear answers for all of those questions, it's really hard to be able to use these fields.

1 Solution

Splunk Employee
Splunk Employee

Hi,

I think this is a documentation issue and that dest_nt_host and dest_fqdn_name are the intended fields. dest_host and dest_name don't appear to actually have any functional declaration in the CIM package. We'll follow up on it, thanks.

-bash-4.1$ cd splunk/etc/apps/Splunk_SA_CIM/default/data/
-bash-4.1$ find models/ -name *.json | xargs grep dest | grep host
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
models/Network_Sessions.json:                   "calculationID":    "All_Sessions_fillnull_dest_nt_host",
models/Network_Sessions.json:                           "fieldName":    "dest_nt_host",
models/Network_Sessions.json:                           "displayName":  "dest_nt_host",
models/Network_Sessions.json:                   "expression":       "if(isnull(dest_nt_host) OR dest_nt_host=\"\",\"unknown\",dest_nt_host)"
-bash-4.1$ 
-bash-4.1$ find models/ -name *.json | xargs grep dest_host
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
-bash-4.1$ 
-bash-4.1$ 
-bash-4.1$ find models/ -name *.json | xargs grep dest | grep name
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
models/Splunk_CIM_Validation.json:                  "search":   "All_Changes.is_Endpoint_Changes=1 AND (object_category=file OR object_category=directory) AND (action=\"unknown\" OR dest=\"unknown\" OR object=\"unknown\" OR object_category=\"unknown\" OR object_path=\"unknown\" OR status=\"unknown\" OR user=\"unknown\" OR file_access_time=0 OR file_create_time=0 OR file_hash=\"unknown\" OR file_modify_time=0 OR file_name=\"unknown\" OR file_path=\"unknown\" OR file_acl=\"unknown\" OR file_size=\"unknown\")"
models/Splunk_CIM_Validation.json:                  "search": "All_Inventory.is_Network=1 AND (dest=\"unknown\" OR NOT (interface=* OR ip=* OR mac=* OR name=* OR dns=*))"
-bash-4.1$ 
-bash-4.1$ find models/ -name *.json | xargs grep dest_name
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
-bash-4.1$ 

View solution in original post

Splunk Employee
Splunk Employee

Hi,

I think this is a documentation issue and that dest_nt_host and dest_fqdn_name are the intended fields. dest_host and dest_name don't appear to actually have any functional declaration in the CIM package. We'll follow up on it, thanks.

-bash-4.1$ cd splunk/etc/apps/Splunk_SA_CIM/default/data/
-bash-4.1$ find models/ -name *.json | xargs grep dest | grep host
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
models/Network_Sessions.json:                   "calculationID":    "All_Sessions_fillnull_dest_nt_host",
models/Network_Sessions.json:                           "fieldName":    "dest_nt_host",
models/Network_Sessions.json:                           "displayName":  "dest_nt_host",
models/Network_Sessions.json:                   "expression":       "if(isnull(dest_nt_host) OR dest_nt_host=\"\",\"unknown\",dest_nt_host)"
-bash-4.1$ 
-bash-4.1$ find models/ -name *.json | xargs grep dest_host
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
-bash-4.1$ 
-bash-4.1$ 
-bash-4.1$ find models/ -name *.json | xargs grep dest | grep name
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
models/Splunk_CIM_Validation.json:                  "search":   "All_Changes.is_Endpoint_Changes=1 AND (object_category=file OR object_category=directory) AND (action=\"unknown\" OR dest=\"unknown\" OR object=\"unknown\" OR object_category=\"unknown\" OR object_path=\"unknown\" OR status=\"unknown\" OR user=\"unknown\" OR file_access_time=0 OR file_create_time=0 OR file_hash=\"unknown\" OR file_modify_time=0 OR file_name=\"unknown\" OR file_path=\"unknown\" OR file_acl=\"unknown\" OR file_size=\"unknown\")"
models/Splunk_CIM_Validation.json:                  "search": "All_Inventory.is_Network=1 AND (dest=\"unknown\" OR NOT (interface=* OR ip=* OR mac=* OR name=* OR dns=*))"
-bash-4.1$ 
-bash-4.1$ find models/ -name *.json | xargs grep dest_name
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
-bash-4.1$ 

View solution in original post

Path Finder

Please note that dest_nt_host and dest_fqdn_name are not defined on the Network Traffic model either. So if you do update the documentation of dest to reference them, please make sure they are defined appropriately.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!