All Apps and Add-ons

Which of the Splunk CIM data models apply to the Forescout CounterACT App?

bigtyma
Communicator

Is anyone the using Forescout CounterAct App? Can anyone tell me which which if any of the Splunk CIM data models apply?

http://docs.splunk.com/Documentation/CIM/3.0.2/User/RelationshipofCIMappstodata

Thank you,

martaBenedetti
Path Finder
0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, it's easiest to think in terms of event types first... the CIM is really built on "type of thing that happened" rather than "brand of thing it happened to".

Totally ignoring the fact that it's a NAC, for any network security device I imagine you'll want to model some events to:

  • Change Analysis -- people often forget this, so I put it first... wouldn't it be nice to get an alert when your network security device gets reconfigured? Especially if the good guys didn't do that reconfig?
  • Authentication -- ditto, I want to know when someone logs into the device. Especially with an administrator level of privilege. That might be good to cross-reference with the add-on for ServiceNow, and see if there's a ticket open against this device...
  • Inventory -- how many do we have and where are they?
  • Performance -- are they barely ticking over, or at their limits?

And since this is a NAC device:

  • I would put the NAC decisions under Change Analysis, tag=network, because you're tracking decisions and configurations that alter the rules of access.
  • If there are actual block and allow events getting logged (e.g. "foo tried to talk to bar and I said no because rule baz"), those would go under Network Traffic.
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...