Splunk Enterprise Security

Enterprise Security: For each ES rule to work, which CIM tags and fields are required and which fields are optional?

laurie_gellatly
Communicator

The CIM model shows which tags are required for that model's ES rules to be active but I still need to ensure that the fields required by each rule are also provided. At present I have to look at the rule's search to determine which fields it requires.
Is there any documentation that shows for ES rule X, tag y and fields a, b and c are required while fields e and f are optional?

i.e. "Access - Excessive Failed Logins - Rule" requires a tag of "authentication", field 'action' must be set to 'failure', 'user' and 'dest' must be set to something useful. 'app' and 'src' are optional.
Looking at these requirements I can see what my own extraction needs to provide for this rule to be active.

Thanks ...Laurie:{)

mcronkrite
Splunk Employee
Splunk Employee

Take a look at this section of the ES Documentation - Mapping Data Sources section that shows what data is needed for each dashboard and has troubleshooting searches to find missing data. Access and the rest are listed.

And then also look at this Dashboard Requirements Matrix for a quick reference as to the fields needed. Any non-mapped fields will have "unknown" as the value.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...