Hi @beano501, From the ES documentation at https://docs.splunk.com/Documentation/ES/7.3.2/Admin/Uploadthreatfile: Parsing STIX documents of version 2.0 and version 2.1 parses STIX observable objects such as type: "observed-data" from the threat intelligence document as outlined in the collections.conf configuration file. The STIX pattern syntax used in STIX "indicator" objects and elsewhere is not currently supported. It's implied the parser expects observed-data objects and then reads observable-container objects from the child objects property. It's explicitly stated that pattern syntax is not supported. This is confirmed in $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/bin/parsers/stix2_parser.py (not shown), where we can see the parser expects the deprecated objects property inside an observed-data object in both STIX 2.0 and STIX 2.1 documents. We probably want something like this: { "type": "bundle", "id": "bundle--50ea61e5-7cce-4a72-a876-bfe45793d235", "spec_version": "2.0", "objects": [ { "type": "threat-actor", "id": "threat-actor--840bb5cd-af46-4c45-9489-43f7bfe612b8", "created": "2023-09-08T00:02:39.000Z", "modified": "2023-09-08T00:02:39.000Z", "name": "Bad Guys", "description": "No, really. They are bad guys.", "labels": [ "uncategorized" ] }, { "type": "observed-data", "id": "observed-data--110847c9-a492-4491-883f-0cea407bb6b1", "created": "2023-09-08T00:02:39.000Z", "modified": "2023-09-08T00:02:39.000Z", "first_observed": "2023-09-08T00:02:39.000Z", "last_observed": "2023-09-08T00:02:39.000Z", "number_observed": 1, "objects": { "0": { "type": "ipv4-addr", "value": "101.38.159.17" } } } ] } For more information about which properties are mapped from the nested object to the ip_intel collection, see the cited collections.conf file at $SPLUNK_HOME/etc/apps/DA-ESS-ThreatIntelligence/default/collections.conf: # STIX2 Mappings to ip_intel # * <collection_field> : <observable-type>.<observable-object-field> - <observable-reference-type>.<reference-object-field> # # * ip : ipv4-addr.value # * : ipv6-addr.value # * domain : domain-name.value # * address : None # * city : None # * country : None # * postal_code : None # * state_prov : None # * oranization_name : None # * organization_id : None # * registration_time : None # * description : None # * threat_key : <id of root element>|<simple filename> # * time : source_processed_time from threat_group_intel # * weight : Parsed from the stanza if downloaded, or required input from user when uploaded # * updated : None # * disabled : false The full list of supported STIX 2.x observed-data objects is: email-message => email_intel ipv4-addr => ip_intel ipv6-addr => ip_intel domain-name => ip_intel file => file_intel network-traffic (with http-request-ext extension) => http_intel process => process_intel process (with windows-service-ext extension) => service_intel windows-registry-key => registry_intel user-account => user_intel x509-certificate => certificate_intel ... View more

Yes, luckily we found the issue. In our case, this behavior showing up when reserved template ID (0-255) is received. The issues had been gone when we updated the template ID 256 or larger.   Hope this help. ... View more

ESCU is a Splunk-supported app so you can submit a Support request about the lack of CIM support.  If that doesn't work, try https://ideas.splunk.com ... View more

Doh 😞   forcepoint_webprotect,index,proxy_forcepoint ... View more

@beano501 My recommendation would be not updating the datamodel as much as possible. One way to achieve what you are looking is to using the 'src_interface' and 'dest_interface' fields in https://docs.splunk.com/Documentation/CIM/5.0.0/User/NetworkTraffic . Populate these fields with your values from the firewall logs, which can then be used in your searches. Additionally the mapping can also be used via lookup table to enrich data as necessary. Additionally, I would also suggest you to capture all your firewalls in a lookup within the ES Assets, using appropriate values in 'category' (e.g. internal_fw, external_fw, dmzfw etc..). This would then be available both in your searches and in your datam ... View more