All Apps and Add-ons

Can someone clarify the intended use for the "app" field under the Authentication data model?

wennebo1
Explorer

We are trying to incorporate many different sources into our Splunk instance under the CIM. What is supposed to go in the app field for the Authentication data model? Is this intended to be the application the user is logging into, or the back-end application the user is using to log in (ldap, shibboleth, etc.)?

0 Karma
1 Solution

zonistj
Path Finder

That's intended to be the application involved in the event. For example, a user attempting to login to an SSH service would be an example of an authentication event, and the "app" would be "SSH" or "SSHD" or something along those lines.

Here's the documentation on the authentication data model:

https://docs.splunk.com/Documentation/CIM/4.13.0/User/Authentication

View solution in original post

zonistj
Path Finder

That's intended to be the application involved in the event. For example, a user attempting to login to an SSH service would be an example of an authentication event, and the "app" would be "SSH" or "SSHD" or something along those lines.

Here's the documentation on the authentication data model:

https://docs.splunk.com/Documentation/CIM/4.13.0/User/Authentication

zonistj
Path Finder

I wanted to add: You generally will want "app" to be the application that the user is logging into.

You can use the authentication mechanism (ldap, etc...) in the metadata fields like source or sourcetype.

0 Karma

wennebo1
Explorer

Your additional comment was what really helped me to understand. I was still a little unsure, as SSH could be the "app" authenticating into an a WordPress server, for example.

Thank you!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...