Is the Add-on for Checkpoint OPSEC LEA CIM Compliant?

[jklumpp_splunk]

Is this add-on CIM compliant and will updates be required to work with the ES app?

[jcoates_splunk · Accepted solution]

Hi, it is CIM compliant.

[bobdeschutter]

I downvoted this post because this add-on may have been cim compliant in 2014, but it's a different story now...

[jbrodsky_splunk]

Note that there are two sourcetypes supported - both "opsec" which is what the LEA input documents as the standard sourcetype for incoming LEA data, and "checkpoint" and if you look at the props.conf provided in the app you can see that both are CIM compliant.