All Apps and Add-ons

Why is so much content developed by Splunk not CIM compliant?


Take for example WinHostMon network or process inputs. The MACAddress field should be "mac". The process input should use "path" instead of "Path" since field names are case sensitive.

Most of the fields in the Nessus TA app are also not CIM compliant.

If Splunk wants to use fields like "Path" or "MACAddress" in the event to make it more human readable, at least provide field aliases to make those inputs CIM compliant.

Can somebody from Splunk please explain why so much of the content you develop is not consistent with the best practices you preach for everybody else? Every TA or input that you create should be CIM compliant out of the box. Your customers shouldn't have to spend time mapping your non-compliant fields to the CIM in order to make something like ES work.

Splunk Employee
Splunk Employee

Thank you for raising this question.

For Nessus TA:
Nessus TA (Splunk Add-on for Tenable) is designed to map CIM:Vulnerabilities and CIM:All_Inventory.OS. We have not mapped 'path' and 'mac', as these two CIM models have no 'path' or 'mac' field. (field ‘mac’ belong to CIM:All_Inventory.Network instead of CIM:All_Inventory.OS). Please feel free to let us know what data model you think should be mapped other than these two designed ones.
CIM has field like 'file_path', 'object_path', but it has no field named 'path'. CIM’s documentation can be found on page:

For general:
We will have an overview of other TAs and their CIM compliance. Do you have any other TAs that you find are not CIM compliant? We will have a further check on these TAs.

0 Karma

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...