Archive
Highlighted

How to find out what SIM model is established for the security logs in Splunk?

Contributor

How to find out what SIM model is established for the security logs in Splunk?

Tags (2)
0 Karma
Highlighted

Re: How to find out what SIM model is established for the security logs in Splunk?

Path Finder

You mean the Common Information Model (CIM)? The reference document is here: http://docs.splunk.com/Documentation/CIM/4.7.0/User/Overview . The latest version is 4.7.0 as of today.

0 Karma
Highlighted

Re: How to find out what SIM model is established for the security logs in Splunk?

Contributor

I mean Security Information Management model established in Splunk for my logs?

0 Karma
Highlighted

Re: How to find out what SIM model is established for the security logs in Splunk?

Builder

Your events will not create CIM datamodels, they are established by the CIM add-on ( https://splunkbase.splunk.com/app/1621/).

If you want to know which datamodel(s) your data adheres to you'll need to look at the data's tag fields and find out which CIM datamodel they are mapped to. Each datamodel has constraints which by default are just tags.

0 Karma