Can I create out of box use cases from Splunk CIM ...

jm1 · ‎10-06-2021

Is it possible to use data models from Common Information Model to use cases in splunk, if so, how can we do that

richgalloway · ‎10-06-2021

Yes, it is possible. That is a big part of what makes Enterprise Security work. You can examine existing correlation searches to see how they use datamodels for various use cases.

---
If this reply helps you, Karma would be appreciated.

Can I create out of box use cases from Splunk CIM data models ?

correlation search

using Enterprise Security

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Buttercup Games: Further Dashboarding Techniques (Part 5)

Customers Increasingly Choose Splunk for Observability