Splunk Enterprise Security

Can I inherit from the CIM Model?

beano501
Engager

We have lots of firewalls (both internal and internet facing) feeding into our CIM Network_Traffic Model within Enterprise Security. I would like to be able to distinguish the traffic that comes from the internet with other traffic.

One way that occurred to be is to modify the CIM Network_Traffic model to have an extra "inheritance" (alongside Allowed_Traffic and Blocked_Traffic). Something line Internet_Traffic with the constraint specifying the appropriate dvc and src_interface values. 

Is this a good idea? Would it break anything? How would it work w.r.t. update/upgrades to the CIM model?

Labels (1)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

@beano501 My recommendation would be not updating the datamodel as much as possible. One way to achieve what you are looking is to using the 'src_interface' and 'dest_interface' fields in https://docs.splunk.com/Documentation/CIM/5.0.0/User/NetworkTraffic . Populate these fields with your values from the firewall logs, which can then be used in your searches. Additionally the mapping can also be used via lookup table to enrich data as necessary.

Additionally, I would also suggest you to capture all your firewalls in a lookup within the ES Assets, using appropriate values in 'category' (e.g. internal_fw, external_fw, dmzfw etc..). This would then be available both in your searches and in your datam

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, you can modify a datamodel, but I don't advise it.  Just like a local modification of a dashboard overrides all future delivered versions of that dashboard, so does a locally modified datamodel never see updates from future CIM releases.

You can do it, but you're committing yourself to having to update your version whenever the delivered version changes.

I'd consider cloning the Network_Traffic DM and modifying the clone to contain only your dataset.  Accelerating that DM will mean running extra searches, but it will be easier to maintain.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...