Match Linux log to CIM

[tdth]

Hi all,

Has anyone had experience matching Linux audit logs to CIM before?

I installed the Add-on for Unix and Linux, but it didn't help. Looking at some of the use cases in Security Essentials, it seems they expect data from EDR solutions like CrowdStrike or Symantec, rather than local Linux audit logs.

Does this mean there is no way to use the out-of-the-box use cases created in Security Essentials/Enterprise Security for Linux logs?

Thanks

[richgalloway · Accepted solution]

Only certain sourcetypes supported by the TA map to CIM datamodels.  The list is at https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/Sourcetypes

If you don't see what you need then you may need to add local aliases, etc. to the TA.

[tdth]

Thanks, so this means only certain out-of-box use cases can be used immediately. The rest would need some works to be done.

[PickleRick]

Actually, with Linux in general, everything needs "some work" to be done.

A"Linux box" is a very broad term and a Linux server can be based on one of many different distributions (or even be installed as LFS), can be configured in a gazillion different ways so while you could cover some typical cases (like RHEL9/default install/default rsyslog configuration), there is no way to cover "any Linux".

Also remember that audit logs depend greatly (mostly, if not exclusively) on which audit rules you have defined in your system.