Splunk SOAR (f.k.a. Phantom)

How to find out what SIM model is established for the security logs in Splunk?

ankithreddy777
Contributor

How to find out what SIM model is established for the security logs in Splunk?

Tags (2)
0 Karma

dflodstrom
Builder

Your events will not create CIM datamodels, they are established by the CIM add-on ( https://splunkbase.splunk.com/app/1621/).

If you want to know which datamodel(s) your data adheres to you'll need to look at the data's tag fields and find out which CIM datamodel they are mapped to. Each datamodel has constraints which by default are just tags.

0 Karma

DavidGuarneri
Path Finder

You mean the Common Information Model (CIM)? The reference document is here: http://docs.splunk.com/Documentation/CIM/4.7.0/User/Overview . The latest version is 4.7.0 as of today.

0 Karma

ankithreddy777
Contributor

I mean Security Information Management model established in Splunk for my logs?

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...