Splunk Enterprise Security

Enterprise Security: For each ES rule to work, which CIM tags and fields are required and which fields are optional?


The CIM model shows which tags are required for that model's ES rules to be active but I still need to ensure that the fields required by each rule are also provided. At present I have to look at the rule's search to determine which fields it requires.
Is there any documentation that shows for ES rule X, tag y and fields a, b and c are required while fields e and f are optional?

i.e. "Access - Excessive Failed Logins - Rule" requires a tag of "authentication", field 'action' must be set to 'failure', 'user' and 'dest' must be set to something useful. 'app' and 'src' are optional.
Looking at these requirements I can see what my own extraction needs to provide for this rule to be active.

Thanks ...Laurie:{)

Splunk Employee
Splunk Employee

Take a look at this section of the ES Documentation - Mapping Data Sources section that shows what data is needed for each dashboard and has troubleshooting searches to find missing data. Access and the rest are listed.

And then also look at this Dashboard Requirements Matrix for a quick reference as to the fields needed. Any non-mapped fields will have "unknown" as the value.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...