Hey y'all, a quick question for the Splunk community and perhaps the developers.
How does Splunk or any SIEM solution recognize a device name from raw data logs? I've been scratching my head trying to figure that out.
It depends. If the device name is in the data then normal Splunk field extractions can pull it out then apply the Common Information Model (CIM) to give the field a recognized name.
If the name is not in the log then the IP address can be used to fetch the device name from a lookup file.