Splunk Add-on for Microsoft Cloud Services CIM mapping not enabled for all Sourcetypes

[becksyboy]

Hi,

We noticed for the Splunk Add-on for Microsoft Cloud Services that CIM mapping is not enabled for all the Sourcetypes.

https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/Sourcetypes/

In particular for the mscs:kql sourcetype we are ingesting Azure Network logs via sourcetype="mscs:kql" Type=AZFWNetworkRule.

I would have expected this Add On to have Network Datamodel CIM mapping included without having to do this ourselves (which we can if required). 

Is this the best Add On to use (or is there a better option) if you want more CIM mapping coverage by default or have you had to do manual CIM mapping when using this TA?

thanks

[becksyboy]

I agree! 🙃 Oh well self service CIM it is.

[marycordova]

LOL/SOB

I really wish there was more compliance around CIM, especially for these TAs built by big industry types...

but yes...self-CIM

[kiran_panchavat]

@becksyboy 

For more comprehensive CIM mapping coverage, you might need to perform manual CIM mapping. The Splunk Add-on Builder can help you map fields from your data events to the fields in any data model, including CIM data models.

Check this https://community.splunk.com/t5/Splunk-Enterprise/Azure-Firewall-Logs-Issue/m-p/703787