Splunk SOAR (f.k.a. Phantom)

How to find out what SIM model is established for the security logs in Splunk?

ankithreddy777
Contributor

How to find out what SIM model is established for the security logs in Splunk?

Tags (2)
0 Karma

dflodstrom
Builder

Your events will not create CIM datamodels, they are established by the CIM add-on ( https://splunkbase.splunk.com/app/1621/).

If you want to know which datamodel(s) your data adheres to you'll need to look at the data's tag fields and find out which CIM datamodel they are mapped to. Each datamodel has constraints which by default are just tags.

0 Karma

DavidGuarneri
Path Finder

You mean the Common Information Model (CIM)? The reference document is here: http://docs.splunk.com/Documentation/CIM/4.7.0/User/Overview . The latest version is 4.7.0 as of today.

0 Karma

ankithreddy777
Contributor

I mean Security Information Management model established in Splunk for my logs?

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...