Splunk Enterprise Security

Enterprise Security: For each ES rule to work, which CIM tags and fields are required and which fields are optional?


The CIM model shows which tags are required for that model's ES rules to be active but I still need to ensure that the fields required by each rule are also provided. At present I have to look at the rule's search to determine which fields it requires.
Is there any documentation that shows for ES rule X, tag y and fields a, b and c are required while fields e and f are optional?

i.e. "Access - Excessive Failed Logins - Rule" requires a tag of "authentication", field 'action' must be set to 'failure', 'user' and 'dest' must be set to something useful. 'app' and 'src' are optional.
Looking at these requirements I can see what my own extraction needs to provide for this rule to be active.

Thanks ...Laurie:{)

Splunk Employee
Splunk Employee

Take a look at this section of the ES Documentation - Mapping Data Sources section that shows what data is needed for each dashboard and has troubleshooting searches to find missing data. Access and the rest are listed.

And then also look at this Dashboard Requirements Matrix for a quick reference as to the fields needed. Any non-mapped fields will have "unknown" as the value.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...