Splunk Enterprise Security

Can I inherit from the CIM Model?

beano501
Engager

We have lots of firewalls (both internal and internet facing) feeding into our CIM Network_Traffic Model within Enterprise Security. I would like to be able to distinguish the traffic that comes from the internet with other traffic.

One way that occurred to be is to modify the CIM Network_Traffic model to have an extra "inheritance" (alongside Allowed_Traffic and Blocked_Traffic). Something line Internet_Traffic with the constraint specifying the appropriate dvc and src_interface values. 

Is this a good idea? Would it break anything? How would it work w.r.t. update/upgrades to the CIM model?

Labels (1)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

@beano501 My recommendation would be not updating the datamodel as much as possible. One way to achieve what you are looking is to using the 'src_interface' and 'dest_interface' fields in https://docs.splunk.com/Documentation/CIM/5.0.0/User/NetworkTraffic . Populate these fields with your values from the firewall logs, which can then be used in your searches. Additionally the mapping can also be used via lookup table to enrich data as necessary.

Additionally, I would also suggest you to capture all your firewalls in a lookup within the ES Assets, using appropriate values in 'category' (e.g. internal_fw, external_fw, dmzfw etc..). This would then be available both in your searches and in your datam

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, you can modify a datamodel, but I don't advise it.  Just like a local modification of a dashboard overrides all future delivered versions of that dashboard, so does a locally modified datamodel never see updates from future CIM releases.

You can do it, but you're committing yourself to having to update your version whenever the delivered version changes.

I'd consider cloning the Network_Traffic DM and modifying the clone to contain only your dataset.  Accelerating that DM will mean running extra searches, but it will be easier to maintain.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...