All Apps and Add-ons
Highlighted

CIM definition for dest_host and dest_name is missing

Path Finder

I was reading the CIM Network Traffic data model definition and found this in the description of the dest field:

The destination of the network traffic (the remote host). You can alias this from more specific fields, such as dest_host, dest_ip, or    dest_name.

The fields dest_host and dest_name are used throughout the models, but are never actually defined anywhere. Are they the same thing, or different things? Can NetBIOS names be used, or only DNS FQDNs? Is the reverse DNS resolution of the destination IP address by a firewall accepted, or only the actual domain that was resolved by the endpoint to perform that network communication?

Without clear answers for all of those questions, it's really hard to be able to use these fields.

Highlighted

Re: CIM definition for dest_host and dest_name is missing

Splunk Employee
Splunk Employee

Hi,

I think this is a documentation issue and that destnthost and destfqdnname are the intended fields. desthost and destname don't appear to actually have any functional declaration in the CIM package. We'll follow up on it, thanks.

-bash-4.1$ cd splunk/etc/apps/Splunk_SA_CIM/default/data/
-bash-4.1$ find models/ -name *.json | xargs grep dest | grep host
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
models/Network_Sessions.json:                   "calculationID":    "All_Sessions_fillnull_dest_nt_host",
models/Network_Sessions.json:                           "fieldName":    "dest_nt_host",
models/Network_Sessions.json:                           "displayName":  "dest_nt_host",
models/Network_Sessions.json:                   "expression":       "if(isnull(dest_nt_host) OR dest_nt_host=\"\",\"unknown\",dest_nt_host)"
-bash-4.1$ 
-bash-4.1$ find models/ -name *.json | xargs grep dest_host
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
-bash-4.1$ 
-bash-4.1$ 
-bash-4.1$ find models/ -name *.json | xargs grep dest | grep name
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
models/Splunk_CIM_Validation.json:                  "search":   "All_Changes.is_Endpoint_Changes=1 AND (object_category=file OR object_category=directory) AND (action=\"unknown\" OR dest=\"unknown\" OR object=\"unknown\" OR object_category=\"unknown\" OR object_path=\"unknown\" OR status=\"unknown\" OR user=\"unknown\" OR file_access_time=0 OR file_create_time=0 OR file_hash=\"unknown\" OR file_modify_time=0 OR file_name=\"unknown\" OR file_path=\"unknown\" OR file_acl=\"unknown\" OR file_size=\"unknown\")"
models/Splunk_CIM_Validation.json:                  "search": "All_Inventory.is_Network=1 AND (dest=\"unknown\" OR NOT (interface=* OR ip=* OR mac=* OR name=* OR dns=*))"
-bash-4.1$ 
-bash-4.1$ find models/ -name *.json | xargs grep dest_name
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
-bash-4.1$ 

View solution in original post

Highlighted

Re: CIM definition for dest_host and dest_name is missing

Path Finder

Please note that dest_nt_host and dest_fqdn_name are not defined on the Network Traffic model either. So if you do update the documentation of dest to reference them, please make sure they are defined appropriately.

0 Karma