All Apps and Add-ons

Will Splunk CIM be updated to include a "parent process hash" field for endpoints?

sethbrunt
Observer

I am trying to ensure I align all logs field names to Splunk CIM but there is not a field for the "Hash of a parent process" under Endpoint - process table:

https://docs.splunk.com/Documentation/CIM/4.13.0/User/Endpoint

I have searched and could use "process_hash" or "file_hash" but these are already used for the running process so may confuse my correlations.

For the time being I will use "parent_process_hash" to keep to the same naming convention unless some one tells me otherwise 🙂

Please let me know if there is a better way

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...