Splunk Enterprise Security

CIM and Physical Access Control Data Model - ES

mikaelbje
Motivator

Hi,

are there any plans to add a Physical Access Control Data Model to the CIM? I'm considering putting physical access control logs (card readers, door openers etc) in ES and would like to know if this is planned. Otherwise I'll have to create my own DM.

Perhaps the Authentication DM could be extended, or create a new one called Access?

Anyone doing this already?

0 Karma
1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

Hi Mikael,

I'll start by asking what you need. There's two reasons for the information models: being able to find information, and being able to make high-speed, low-resolution decisions from the data. Examples:

  1. I have twelve brands of card reader system and I want to look in the same field to find the friendly name of the protected location.
  2. I want to make a correlation search from accelerated fields that are specific to card readers.

I was trying to make up a card-reader specific correlation search that isn't just replication of an existing correlation search, but I'm not able to think of one. For instance, Brute Force or Impossible Access... tag the data as authentication and you're covered. Privilege escalation, tag the account management stuff...

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

Hi Mikael,

I'll start by asking what you need. There's two reasons for the information models: being able to find information, and being able to make high-speed, low-resolution decisions from the data. Examples:

  1. I have twelve brands of card reader system and I want to look in the same field to find the friendly name of the protected location.
  2. I want to make a correlation search from accelerated fields that are specific to card readers.

I was trying to make up a card-reader specific correlation search that isn't just replication of an existing correlation search, but I'm not able to think of one. For instance, Brute Force or Impossible Access... tag the data as authentication and you're covered. Privilege escalation, tag the account management stuff...

mikaelbje
Motivator

You're right. The existing DMs should be good enough for now. Re-using saves a few CPU cycles and a lot of memory. If I come into a situation that requires its own model I'll let you know. There may be card reader specifics but that's not really my field so I can't think of a case that requires a DM on its own

0 Karma

mcronkrite_splu
Splunk Employee
Splunk Employee

We use Authentication Data Model, it makes it easy to correlate between door access and computer access. Just leverage the DVC or the SRC_host field to indicate the door name/id.

0 Karma

mikaelbje
Motivator

Yep,I ended up doing this and prefixing the src field with "Door_". Now I just need to populate all the asset lists. Blah!

If anyone is interested in seeing an example implementation, it's available here: https://github.com/inspired/TA-Stanley-Access_Control

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...