How to find out what SIM model is established for the security logs in Splunk?

[ankithreddy777]

How to find out what SIM model is established for the security logs in Splunk?

[dflodstrom]

Your events will not create CIM datamodels, they are established by the CIM add-on ( https://splunkbase.splunk.com/app/1621/).

If you want to know which datamodel(s) your data adheres to you'll need to look at the data's tag fields and find out which CIM datamodel they are mapped to. Each datamodel has constraints which by default are just tags.

[DavidGuarneri]

You mean the Common Information Model (CIM)? The reference document is here: http://docs.splunk.com/Documentation/CIM/4.7.0/User/Overview . The latest version is 4.7.0 as of today.

[ankithreddy777]

I mean Security Information Management model established in Splunk for my logs?