Security

Malware Operations CIM, catering for multiple engines and pattern types

stephanbuys
Path Finder

Hi,

I am currently adapting sourcetypes for Trend Micro Products to the the CIM, in order to use them with ES and the CIM app.

The CIM caters for:

  • product
  • vendor
  • product_version
  • signature_version

However, the products I deal with have multiple scanning engines as well as multiple pattern file types. I thus propose some new fields:

  • engine
  • engine_version
  • signature_type
  • signature_version

Perhaps signature_version can then be created using an eval of the specified fields.

Regards,
Stephan

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

Hi Stephan,

good suggestions, we'll look into this for the future. In the meantime, you're probably best off treating each engine version as a different product type for simplicity's sake.

View solution in original post

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi Stephan,

good suggestions, we'll look into this for the future. In the meantime, you're probably best off treating each engine version as a different product type for simplicity's sake.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...