Data Models CIM compliance how to indetify data sources needed for the Data Sets individual fields

[DanAlexander]

Hi All, trying to identify what data source/sourcetype is needed for each individual field while performing Data Model CIM normalization. For example for Endpoint->Ports/Data Set (https://docs.splunk.com/Documentation/CIM/5.2.0/User/Endpoint) there is a table with 5 columns Dataset Name/Field name/Data type/Description/Abbreviated list of example values/, but there is no guidance of what data source is needed for each individual field to start populating. As an example, I recently found that for the Registry Data Set it needs WinRegMon stanza (configuring this is another challenge 🙂) to be able to recognise and start parsing data. Any help much appreciated!

[gcusello · Accepted solution]

Hi @DanAlexander,

the correct approach, in my opinion, is:

• identify your Data Sources,
• identify in Splunkbase the best Add-Ons for your Data Sources.

The CIM4.x compliant Add-Ons are ready to be used without any action.

If instead you have some data source without a CIM 4.x complaint Add-On, you have to create it using the Add-On Builder (https://splunkbase.splunk.com/app/2962) and the SA-CIM-Vladiator (https://splunkbase.splunk.com/app/2968) apps that guide you in this actions.

Following your example: WinRegMon  belongs to the Splunk_TA_Windows Add-On that's CIM 4.x Compliant, so you don't need to perform any action.

Ciao.

Giuseppe

[DanAlexander]

Hi @gcusello thanks for your reply.

Agree with what you suggested. However, I found it challenging to recognize stanzas that can be used for completing each individual field. I am using Vladiator and filling in gaps that way. 

From what you said "Following your example: WinRegMon  belongs to the Splunk_TA_Windows Add-On that's CIM 4.x Compliant, so you don't need to perform any action." 

WinRegMon was there but I had to discover it myself as all options that come under the default folder/inputs.conf are lots and they are disabled by default for the user to decide on which ones to enable and for what purpose.

Would you be able to help me identify the best and appropriate way to decide on how to enable the Ports Data Set's fields (currently not getting any data in...is ti coming from SysMon or any other data sourcetype?) from the Endpoint Data Model?

Hope you can understand my challenge.