The Ziften ZFlow Add-on is responsible for ingesting Ziften ZFlow data into Splunk and convert it in to Splunk's Common Information Model (CIM) for data indexing and integration with Splunk Enterprise Security (Splunk ES)