Splunk Enterprise Security

Can I inherit from the CIM Model?


We have lots of firewalls (both internal and internet facing) feeding into our CIM Network_Traffic Model within Enterprise Security. I would like to be able to distinguish the traffic that comes from the internet with other traffic.

One way that occurred to be is to modify the CIM Network_Traffic model to have an extra "inheritance" (alongside Allowed_Traffic and Blocked_Traffic). Something line Internet_Traffic with the constraint specifying the appropriate dvc and src_interface values. 

Is this a good idea? Would it break anything? How would it work w.r.t. update/upgrades to the CIM model?

Labels (1)
0 Karma


@beano501 My recommendation would be not updating the datamodel as much as possible. One way to achieve what you are looking is to using the 'src_interface' and 'dest_interface' fields in https://docs.splunk.com/Documentation/CIM/5.0.0/User/NetworkTraffic . Populate these fields with your values from the firewall logs, which can then be used in your searches. Additionally the mapping can also be used via lookup table to enrich data as necessary.

Additionally, I would also suggest you to capture all your firewalls in a lookup within the ES Assets, using appropriate values in 'category' (e.g. internal_fw, external_fw, dmzfw etc..). This would then be available both in your searches and in your datam

0 Karma


Yes, you can modify a datamodel, but I don't advise it.  Just like a local modification of a dashboard overrides all future delivered versions of that dashboard, so does a locally modified datamodel never see updates from future CIM releases.

You can do it, but you're committing yourself to having to update your version whenever the delivered version changes.

I'd consider cloning the Network_Traffic DM and modifying the clone to contain only your dataset.  Accelerating that DM will mean running extra searches, but it will be easier to maintain.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...