Archive

How to find out what SIM model is established for the security logs in Splunk?

Contributor

How to find out what SIM model is established for the security logs in Splunk?

Tags (2)
0 Karma

Builder

Your events will not create CIM datamodels, they are established by the CIM add-on ( https://splunkbase.splunk.com/app/1621/).

If you want to know which datamodel(s) your data adheres to you'll need to look at the data's tag fields and find out which CIM datamodel they are mapped to. Each datamodel has constraints which by default are just tags.

0 Karma

Path Finder

You mean the Common Information Model (CIM)? The reference document is here: http://docs.splunk.com/Documentation/CIM/4.7.0/User/Overview . The latest version is 4.7.0 as of today.

0 Karma

Contributor

I mean Security Information Management model established in Splunk for my logs?

0 Karma