All Apps and Add-ons
Highlighted

Network Traffic vs Endpoint.Ports

New Member

Looking at the Network Traffic data model (https://docs.splunk.com/Documentation/CIM/4.13.0/User/NetworkTraffic), it only provides: "The fields and tags in the Network Traffic data model describe flows of data across network infrastructure components."

Looking at the Ports data set in the Endpoint data model (https://docs.splunk.com/Documentation/CIM/4.13.0/User/Endpoint), "The fields and tags in the Endpoint data model describe service or process inventory and state, such as Unix daemons, Windows services, running processes on any OS, or similar systems. "

Does that mean network connections from endpoints shouldn't be mapped to "Network Traffic"?

0 Karma