Getting Data In

Data Models CIM compliance how to indetify data sources needed for the Data Sets individual fields

DanAlexander
Communicator

Hi All, trying to identify what data source/sourcetype is needed for each individual field while performing Data Model CIM normalization. For example for Endpoint->Ports/Data Set (https://docs.splunk.com/Documentation/CIM/5.2.0/User/Endpoint) there is a table with 5 columns Dataset Name/Field name/Data type/Description/Abbreviated list of example values/, but there is no guidance of what data source is needed for each individual field to start populating. As an example, I recently found that for the Registry Data Set it needs WinRegMon stanza (configuring this is another challenge 🙂) to be able to recognise and start parsing data. Any help much appreciated!

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander,

the correct approach, in my opinion, is:

  • identify your Data Sources,
  • identify in Splunkbase the best Add-Ons for your Data Sources.

The CIM4.x compliant Add-Ons are ready to be used without any action.

If instead you have some data source without a CIM 4.x complaint Add-On, you have to create it using the Add-On Builder (https://splunkbase.splunk.com/app/2962) and the SA-CIM-Vladiator (https://splunkbase.splunk.com/app/2968) apps that guide you in this actions.

Following your example: WinRegMon  belongs to the Splunk_TA_Windows Add-On that's CIM 4.x Compliant, so you don't need to perform any action.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander,

the correct approach, in my opinion, is:

  • identify your Data Sources,
  • identify in Splunkbase the best Add-Ons for your Data Sources.

The CIM4.x compliant Add-Ons are ready to be used without any action.

If instead you have some data source without a CIM 4.x complaint Add-On, you have to create it using the Add-On Builder (https://splunkbase.splunk.com/app/2962) and the SA-CIM-Vladiator (https://splunkbase.splunk.com/app/2968) apps that guide you in this actions.

Following your example: WinRegMon  belongs to the Splunk_TA_Windows Add-On that's CIM 4.x Compliant, so you don't need to perform any action.

Ciao.

Giuseppe

DanAlexander
Communicator

Hi @gcusello thanks for your reply.

Agree with what you suggested. However, I found it challenging to recognize stanzas that can be used for completing each individual field. I am using Vladiator and filling in gaps that way. 

From what you said "Following your example: WinRegMon  belongs to the Splunk_TA_Windows Add-On that's CIM 4.x Compliant, so you don't need to perform any action." 

WinRegMon was there but I had to discover it myself as all options that come under the default folder/inputs.conf are lots and they are disabled by default for the user to decide on which ones to enable and for what purpose.

Would you be able to help me identify the best and appropriate way to decide on how to enable the Ports Data Set's fields (currently not getting any data in...is ti coming from SysMon or any other data sourcetype?) from the Endpoint Data Model?

Hope you can understand my challenge.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...