CIM and Physical Access Control Data Model - ES

[mikaelbje]

Hi,

are there any plans to add a Physical Access Control Data Model to the CIM? I'm considering putting physical access control logs (card readers, door openers etc) in ES and would like to know if this is planned. Otherwise I'll have to create my own DM.

Perhaps the Authentication DM could be extended, or create a new one called Access?

Anyone doing this already?

[jcoates_splunk · Accepted solution]

Hi Mikael,

I'll start by asking what you need. There's two reasons for the information models: being able to find information, and being able to make high-speed, low-resolution decisions from the data. Examples:

1. I have twelve brands of card reader system and I want to look in the same field to find the friendly name of the protected location.
2. I want to make a correlation search from accelerated fields that are specific to card readers.

I was trying to make up a card-reader specific correlation search that isn't just replication of an existing correlation search, but I'm not able to think of one. For instance, Brute Force or Impossible Access... tag the data as authentication and you're covered. Privilege escalation, tag the account management stuff...

[mikaelbje]

You're right. The existing DMs should be good enough for now. Re-using saves a few CPU cycles and a lot of memory. If I come into a situation that requires its own model I'll let you know. There may be card reader specifics but that's not really my field so I can't think of a case that requires a DM on its own

[mcronkrite_splu]

We use Authentication Data Model, it makes it easy to correlate between door access and computer access. Just leverage the DVC or the SRC_host field to indicate the door name/id.

[mikaelbje]

Yep,I ended up doing this and prefixing the src field with "Door_". Now I just need to populate all the asset lists. Blah!

If anyone is interested in seeing an example implementation, it's available here: https://github.com/inspired/TA-Stanley-Access_Control