mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Add the initial cut at datamodel and yaml parser. Include all of the datamodels, with the Risk.json and EUBA.json models as well.
This commit is contained in:
pyth0n1c
@@ -0,0 +1,363 @@
|
||||
from curses.ascii import TAB
|
||||
from dataclasses import dataclass, field
|
||||
import json
|
||||
import pathlib
|
||||
import sys
|
||||
import re
|
||||
|
||||
TAB_CHARACTER='\t'
|
||||
|
||||
DATAMODEL_PATTERN = r"datamodel\s*=\s*\S*"
|
||||
QUOTATIONS_PATTERN = r'''(["'])(?:(?=(\\?))\2.)*?\1'''
|
||||
KEY_VALUE_PATTERN = r"[a-zA-Z0-9_]+\.[a-zA-Z0-9_]+"
|
||||
|
||||
class DatamodelRoot:
|
||||
def __init__(self, paths:list[pathlib.Path]):
|
||||
self.datamodels = {}
|
||||
for p in paths:
|
||||
if p.is_file():
|
||||
self.add_datamodel_file(p)
|
||||
elif p.is_dir():
|
||||
self.add_datamodel_directory(p)
|
||||
else:
|
||||
raise(Exception(f"Path {p} is neither a directory nor a path"))
|
||||
|
||||
print(f"Processed [{len(self.datamodels)}] datamodels")
|
||||
|
||||
def add_datamodel_file(self, path:pathlib.Path)->None:
|
||||
dm = Datamodel(path)
|
||||
self.datamodels[dm.name] = dm
|
||||
|
||||
def add_datamodel_directory(self, directory_path:pathlib.Path)->None:
|
||||
for filePath in directory_path.rglob("*.json"):
|
||||
self.add_datamodel_file(filePath)
|
||||
|
||||
def pretty_print(self, indent_spaces:int = 3):
|
||||
for dm_name, dm_obj in self.datamodels.items():
|
||||
print(f"{dm_obj.name} - {dm_obj.path}")
|
||||
|
||||
for object_name, object_item in dm_obj.objects.items():
|
||||
print(' ' * (indent_spaces*1) + object_item.name)
|
||||
for field_name, field_object in object_item.fields.items():
|
||||
print(' ' * (indent_spaces*2) + field_object.name)
|
||||
|
||||
def resolve_fieldname(self, full_path:str)->list[str]:
|
||||
|
||||
segments = full_path.split('.')
|
||||
if len(segments) == 3:
|
||||
paths = self.resolve_three_part_field_name(segments[0], segments[1], segments[2])
|
||||
|
||||
elif len(segments) == 2:
|
||||
paths = self.resolve_two_part_field_name(segments[0], segments[1])
|
||||
elif len(segments) == 1:
|
||||
paths = self.resolve_one_part_field_name(segments[0])
|
||||
else:
|
||||
raise(Exception(f"Could not resolve the reference to {full_path} in any datamodel"))
|
||||
|
||||
#if len(paths) == 0:
|
||||
# print(f"Failed to find [{full_path}]")
|
||||
return sorted(paths)
|
||||
|
||||
def resolve_three_part_field_name(self, datamodelName:str, submodelName:str, fieldName:str)->list[str]:
|
||||
paths = []
|
||||
if datamodelName in self.datamodels:
|
||||
dm = self.datamodels[datamodelName]
|
||||
if submodelName in dm.objects:
|
||||
objs = dm.objects[submodelName]
|
||||
if fieldName in objs.fields:
|
||||
field = objs.fields[fieldName]
|
||||
paths.append(f"{dm.name}.{objs.name}.{field.name}")
|
||||
return paths
|
||||
|
||||
def resolve_two_part_field_name(self, submodelName:str, fieldName:str)->list[str]:
|
||||
paths = []
|
||||
for dm_name in self.datamodels:
|
||||
paths += self.resolve_three_part_field_name(dm_name, submodelName, fieldName)
|
||||
return paths
|
||||
|
||||
def resolve_one_part_field_name(self, fieldName:str)->list[str]:
|
||||
paths = []
|
||||
for dmName, dmObject in self.datamodels.items():
|
||||
for objectName, objectObject in dmObject.objects.items():
|
||||
paths += self.resolve_three_part_field_name(dmName, objectName, fieldName)
|
||||
return paths
|
||||
|
||||
def validate_model_and_submodel(self, modelAndSubmodel:str)->bool:
|
||||
parts = modelAndSubmodel.split('.')
|
||||
if len(parts) == 1:
|
||||
model = parts[0]
|
||||
if model in self.datamodels:
|
||||
return True
|
||||
elif len(parts) == 2:
|
||||
model = parts[0]
|
||||
submodel = parts[1]
|
||||
if model in self.datamodels:
|
||||
if submodel in self.datamodels[model].objects:
|
||||
return True
|
||||
else:
|
||||
raise(Exception(f"Submodel {submodel} not found in the {model} Datamodel: {self.datamodels[model].objects.keys()}"))
|
||||
else:
|
||||
raise(Exception(f"Model {model} not found in the valid datamodels: {self.datamodels.keys()}"))
|
||||
|
||||
else:
|
||||
raise(Exception(f"The datamodel {modelAndSubmodel} was not in the expected format of 'model[.submodel]'"))
|
||||
|
||||
|
||||
raise(Exception(f"The datamodel {modelAndSubmodel} was not found in the defined datamodels and submodels"))
|
||||
|
||||
class Datamodel:
|
||||
def __init__(self, path:pathlib.Path):
|
||||
self.path = path
|
||||
with open(path, 'r') as datamodel_file:
|
||||
model = json.load(datamodel_file)
|
||||
|
||||
#print(f"Parsing Datamodel [{model['modelName']}]...")
|
||||
self.name = model['modelName']
|
||||
self.objects = {}
|
||||
if 'objects' in model:
|
||||
self.parse_objects(model['objects'])
|
||||
else:
|
||||
raise(Exception(f"Datamodel file [{self.path}] did not contain 'objects'"))
|
||||
|
||||
|
||||
|
||||
def parse_objects(self, json_objects: list,depth:int=0):
|
||||
for json_object in json_objects:
|
||||
datamodel_object = DatamodelObject(json_object)
|
||||
self.objects[datamodel_object.name] = datamodel_object
|
||||
|
||||
|
||||
class DatamodelObject:
|
||||
def __init__(self, datamodel_object: dict):
|
||||
|
||||
self.name = datamodel_object['objectName']
|
||||
self.fields = {}
|
||||
if 'fields' in datamodel_object:
|
||||
self.parse_fields(datamodel_object['fields'])
|
||||
#else:
|
||||
# print(f"'fields' not found in datamodel object {self.name}")
|
||||
if 'calculations' in datamodel_object:
|
||||
self.parse_calculations(datamodel_object['calculations'])
|
||||
#else:
|
||||
# print(f"'calculations' not found in datamodel object {self.name}")
|
||||
|
||||
def parse_fields(self, fields_object: list):
|
||||
for field in fields_object:
|
||||
field = DatamodelField(field)
|
||||
self.fields[field.name] = field
|
||||
def parse_calculations(self, calculations_object: list):
|
||||
for calculation in calculations_object:
|
||||
self.parse_fields(calculation['outputFields'])
|
||||
|
||||
|
||||
|
||||
|
||||
class DatamodelField:
|
||||
def __init__(self, datamodel_field: dict):
|
||||
self.name = datamodel_field['fieldName']
|
||||
#class DatamodelCalculation:
|
||||
# def __init__(self, datamodel_calculation: dict):
|
||||
# self.name = datamodel_calculation[]
|
||||
# pass
|
||||
|
||||
|
||||
class SearchFieldValidator:
|
||||
def __init__(self, path:pathlib.Path, yaml_search:str, yaml_datamodels: set[str], yaml_required_fields: set[str], datamodelRoot: DatamodelRoot, errorOnMissingSubmodel:bool=True):
|
||||
self.path = path
|
||||
self.yaml_search = yaml_search
|
||||
self.yaml_datamodels = yaml_datamodels
|
||||
self.yaml_required_fields = yaml_required_fields
|
||||
self.errorOnMissingSubmodel = errorOnMissingSubmodel
|
||||
self.datamodelRoot = datamodelRoot
|
||||
self.datamodels_declared_in_search = self.extractDatamodelsFromSearch()
|
||||
self.fields_from_search = self.extractFieldsFromSearch()
|
||||
|
||||
self.datamodels_used_in_search = set()
|
||||
|
||||
|
||||
#print("Datamodels:")
|
||||
#print(self.search_datamodels_from_search)
|
||||
#print("Fields:")
|
||||
#print(self.fields_from_search)
|
||||
self.updated = False
|
||||
self.valid_search = self.validate_search()
|
||||
|
||||
if self.updated:
|
||||
print("yes, it was updated")
|
||||
|
||||
def extractDatamodelsFromSearch(self, interactive:bool=False)->set[str]:
|
||||
#First search includes the beginning datamodel= (including whitespace)
|
||||
all_data_models = re.findall(DATAMODEL_PATTERN, self.yaml_search)
|
||||
|
||||
#Trim off the beginning datamodel= and leading and trailing
|
||||
cleaned_models = set()
|
||||
for datamodel in all_data_models:
|
||||
try:
|
||||
equals_and_datamodel = datamodel.split('=')
|
||||
|
||||
if len(equals_and_datamodel) != 2:
|
||||
#print("\n")
|
||||
#print(self.yaml_search)
|
||||
#print(datamodel)
|
||||
#print(equals_and_datamodel)
|
||||
#sys.exit(1)
|
||||
raise(Exception(f"Expected format 'datamodel=Model.submodel' but received {datamodel}, parsed as {equals_and_datamodel}"))
|
||||
|
||||
cleaned_datamodel = equals_and_datamodel[1].strip().rstrip()
|
||||
if '.' not in cleaned_datamodel and self.errorOnMissingSubmodel:
|
||||
#raise(Exception(f"No submodel contained in datamodel [{datamodel}]"))
|
||||
pass
|
||||
if not self.datamodelRoot.validate_model_and_submodel(cleaned_datamodel):
|
||||
raise(Exception(f"The datamodel and submodel {cleaned_datamodel} do not exist in the parsed datamodels"))
|
||||
cleaned_models.add(cleaned_datamodel)
|
||||
|
||||
|
||||
except Exception as e:
|
||||
raise(Exception(f"Error trying to extract the Datamodel from datamodel [{datamodel}]: {str(e)}"))
|
||||
return cleaned_models
|
||||
|
||||
|
||||
def extractFieldsFromSearch(self)->list[str]:
|
||||
#First, remove the datamodel(s) from the search
|
||||
all_data_models = re.findall(DATAMODEL_PATTERN, self.yaml_search)
|
||||
search_without_datamodels = self.yaml_search
|
||||
for dms in all_data_models:
|
||||
search_without_datamodels = search_without_datamodels.replace(dms, "")
|
||||
|
||||
#Remove all of the quoted text. We do this because things like cmd.exe could be
|
||||
#interpreted as a field. In reality, we need to quote these in the raw files
|
||||
#so that they can be removed during this step
|
||||
search_without_quoted_text = re.sub(QUOTATIONS_PATTERN, "", search_without_datamodels)
|
||||
return re.findall(KEY_VALUE_PATTERN, search_without_quoted_text)
|
||||
|
||||
def validate_search(self, interactive:bool = False)->bool:
|
||||
validation_success = True
|
||||
|
||||
for fieldname in self.fields_from_search:
|
||||
print(fieldname)
|
||||
found_fields = self.datamodelRoot.resolve_fieldname(fieldname)
|
||||
if len(found_fields) == 0:
|
||||
print(f"Failed to validate field name [{fieldname}] - field does not exist in any datamodels")
|
||||
validation_success = False
|
||||
elif len(found_fields) > 1:
|
||||
print(f"Failed to validate field name [{fieldname}] - field exists in more than one datamodel: {found_fields}")
|
||||
validation_success = False
|
||||
else:
|
||||
fully_qualified_field = found_fields[0]
|
||||
model = fully_qualified_field.split('.')[0]
|
||||
modelAndSubmodel = ".".join(fully_qualified_field.split('.')[0:2])
|
||||
self.datamodels_used_in_search.add(modelAndSubmodel)
|
||||
|
||||
if self.datamodels_used_in_search != self.datamodels_declared_in_search != self.yaml_datamodels:
|
||||
print(f"Difference between declared datamodels and used datamodels in {self.path}")
|
||||
print(f"1) Parsed from YAML Field: {self.yaml_datamodels}")
|
||||
print(f"2) Declared in Search : {self.datamodels_declared_in_search}")
|
||||
print(f"3) Extracted from Search : {self.datamodels_used_in_search}")
|
||||
print('\n')
|
||||
if interactive:
|
||||
dm_choices = [1,2,3]
|
||||
choice = input(f"Which one do you want to keep {dm_choices}: ")
|
||||
if choice == '1':
|
||||
print("No change")
|
||||
self.updated = False
|
||||
elif choice == '2':
|
||||
self.updated = True
|
||||
elif choice == '3':
|
||||
self.updated = True
|
||||
else:
|
||||
raise(Exception(f"Bad choice: {choice}, not one of {dm_choices}"))
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
'''
|
||||
print(f"Was validation successful? {validation_success}")
|
||||
#print(self.fields_from_search)
|
||||
print(self.datamodels_declared_in_search)
|
||||
print(self.datamodels_used_in_search)
|
||||
if self.datamodels_declared_in_search != self.datamodels_used_in_search != self.yaml_datamodels:
|
||||
print("Difference between the datamodels declared in the search and the datamodels used in the search")
|
||||
print(f"FROM : {self.datamodels_declared_in_search}")
|
||||
print(f"USED : {self.datamodels_used_in_search}")
|
||||
print(f"YAML : {self.yaml_datamodels}")
|
||||
'''
|
||||
|
||||
|
||||
|
||||
|
||||
return validation_success
|
||||
|
||||
|
||||
|
||||
|
||||
return True
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
import sys
|
||||
datamodel_argument = [sys.argv[1]]
|
||||
detection_argument = [sys.argv[2]]
|
||||
interactive = sys.argv[3]
|
||||
#input_paths = [pathlib.Path(input_path_argument) for input_path_argument in input_path_arguments]
|
||||
datamodel_paths = [pathlib.Path(input_path_argument) for input_path_argument in datamodel_argument]
|
||||
root = DatamodelRoot(datamodel_paths)
|
||||
|
||||
|
||||
import yaml
|
||||
detection_paths = [pathlib.Path(detection_path_argument) for detection_path_argument in detection_argument]
|
||||
|
||||
|
||||
#glob all the yml files in that directory
|
||||
|
||||
total_searches = 0
|
||||
errored_searches = 0
|
||||
valid_searches = 0
|
||||
failed_searches = 0
|
||||
for p in detection_paths:
|
||||
for filePath in p.rglob("*.yml"):
|
||||
if "short_lived_windows_account" not in str(filePath):
|
||||
continue
|
||||
total_searches += 1
|
||||
with open(filePath, 'rb') as detection_data:
|
||||
try:
|
||||
dat = yaml.safe_load(detection_data)
|
||||
search = dat['search']
|
||||
decalared_dms = dat['datamodel']
|
||||
declared_required_fields = dat['tags']['required_fields']
|
||||
#print(filePath)
|
||||
valid = SearchFieldValidator(filePath, search, decalared_dms, declared_required_fields, root)
|
||||
if valid.valid_search == True:
|
||||
valid_searches += 1
|
||||
else:
|
||||
failed_searches += 1
|
||||
|
||||
except Exception as e:
|
||||
print(f"Error testing [{filePath}]: {str(e)}")
|
||||
errored_searches += 1
|
||||
|
||||
print("Summary")
|
||||
print(f"Total Searches: {total_searches: >4}")
|
||||
print(f"Passed Searches: {valid_searches: >4}")
|
||||
print(f"Failed Searches: {failed_searches: >4}")
|
||||
print(f"Errored Searches: {errored_searches: >4}")
|
||||
|
||||
|
||||
'''
|
||||
example_search = '| tstats `security_content_summariesonly` values(All_Changes.result_id) as\
|
||||
result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change\
|
||||
where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h\
|
||||
All_Changes.user All_Changes.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`\
|
||||
| `drop_dm_object_name("All_Changes")` | search result_id = 4720 result_id=4726\
|
||||
| transaction user connected=false maxspan=240m | table firstTime lastTime count\
|
||||
user dest result_id | `short_lived_windows_accounts_filter`'
|
||||
example_datamodels = {"Change"}
|
||||
example_required_fields = {"_time", "All_Changes.result_id", "All_Changes.user","All_Changes.dest"}
|
||||
example_path_string = "/tmp/scann/security_content/detections/endpoint/short_lived_windows_accounts.yml"
|
||||
examplePath = pathlib.Path(example_path_string)
|
||||
s = SearchFieldValidator(examplePath, example_search, example_datamodels, example_required_fields, root)
|
||||
'''
|
||||
@@ -0,0 +1,468 @@
|
||||
{
|
||||
"modelName": "Alerts",
|
||||
"displayName": "Alerts",
|
||||
"description": "Alerts Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"alert"
|
||||
]
|
||||
},
|
||||
"objectName": "Alerts",
|
||||
"displayName": "Alerts",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is deprecated in favor of 'description'."
|
||||
},
|
||||
"fieldName": "body",
|
||||
"displayName": "body",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The description of the alert event."
|
||||
},
|
||||
"fieldName": "description",
|
||||
"displayName": "description",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit associated with the destination. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the destination. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the destination. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The type of the destination object, such as 'instance', 'storage', 'firewall'."
|
||||
},
|
||||
"fieldName": "dest_type",
|
||||
"displayName": "dest_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique identifier of the alert event."
|
||||
},
|
||||
"fieldName": "id",
|
||||
"displayName": "id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The MITRE ATT&CK technique ID of the alert event, searchable at https:\/\/attack.mitre.org\/techniques"
|
||||
},
|
||||
"fieldName": "mitre_technique_id",
|
||||
"displayName": "mitre_technique_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The numeric or vendor specific severity indicator corresponding to the event severity."
|
||||
},
|
||||
"fieldName": "severity_id",
|
||||
"displayName": "severity_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The human-friendly title of the alert event, such as 'API GetAccountPasswordPolicy was invoked using root credentials.' Split by signature_id when aggregating alert events by types."
|
||||
},
|
||||
"fieldName": "signature",
|
||||
"displayName": "signature",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit associated with the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_bunit",
|
||||
"displayName": "src_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_category",
|
||||
"displayName": "src_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_priority",
|
||||
"displayName": "src_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The type of the source object, such as 'instance', 'storage', 'firewall'."
|
||||
},
|
||||
"fieldName": "src_type",
|
||||
"displayName": "src_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is deprecated in favor of 'signature'."
|
||||
},
|
||||
"fieldName": "subject",
|
||||
"displayName": "subject",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the user involved in the alert event. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_bunit",
|
||||
"displayName": "user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the user involved in the alert event. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_category",
|
||||
"displayName": "user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the user involved in the alert event. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_priority",
|
||||
"displayName": "user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The account associated with the alert event."
|
||||
},
|
||||
"fieldName": "vendor_account",
|
||||
"displayName": "vendor_account",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The data center region involved in the alert event, such as us-west-2."
|
||||
},
|
||||
"fieldName": "vendor_region",
|
||||
"displayName": "vendor_region",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Alerts_fillnull_app",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The system, service, or application that generated the alert event. Examples include, but are not limited to the following: GuardDuty, SecurityCenter, 3rd party services, win:app:trendmicro, vmware, nagios.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "app",
|
||||
"displayName": "app",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(app) OR app=\"\",sourcetype,app)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Alerts_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The object that is the 'target' of the alert event. Examples include an email address, SNMP trap, or virtual machine id. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Alerts_fillnull_severity",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The severity of the alert event. Note: This field is a string. Specific values are required. Use the severity_id field for severity ID fields that are integer data types. Use vendor_severity for the vendor's own human readable strings (such as 'Good', 'Bad', 'Really Bad').",
|
||||
"expected_values": [
|
||||
"critical",
|
||||
"high",
|
||||
"medium",
|
||||
"low",
|
||||
"informational",
|
||||
"unknown"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "severity",
|
||||
"displayName": "severity",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Alerts_fillnull_signature_id",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor specific policy or rule that generated the alert event, such as 'Policy:IAMUser/RootCredentialUsage.'",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "signature_id",
|
||||
"displayName": "signature_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(signature_id) OR signature_id=\"\",\"unknown\",signature_id)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Alerts_fillnull_src",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The object that is the 'actor' of the alert event. You can alias or extract this from more specific fields, such as src_host, src_ip, or src_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "src",
|
||||
"displayName": "src",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(src) OR src=\"\",\"unknown\",src)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Alerts_fillnull_type",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The alert event type.",
|
||||
"expected_values": [
|
||||
"alarm",
|
||||
"alert",
|
||||
"event",
|
||||
"task",
|
||||
"warning",
|
||||
"unknown"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "type",
|
||||
"displayName": "type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(type) OR type=\"\",\"unknown\",type)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Alerts_fillnull_user",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user involved in the alert event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(user) OR user=\"\",\"unknown\",user)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Alerts_fillnull_user_name",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user_name of user involved in the alert event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "user_name",
|
||||
"displayName": "user_name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(user_name) OR user_name=\"\",\"unknown\",user_name)"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Alerts_indexes`) tag=alert"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,502 @@
|
||||
{
|
||||
"modelName": "Application_State",
|
||||
"displayName": "Application State (Deprecated)",
|
||||
"description": "This model has been deprecated",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"ta_relevant": false
|
||||
},
|
||||
"objectName": "All_Application_State",
|
||||
"displayName": "All Application State",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_requires_av",
|
||||
"displayName": "dest_requires_av",
|
||||
"type": "boolean",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_should_timesync",
|
||||
"displayName": "dest_should_timesync",
|
||||
"type": "boolean",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_should_update",
|
||||
"displayName": "dest_should_update",
|
||||
"type": "boolean",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user account the service is running as, such as System or httpdsvc."
|
||||
},
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_bunit",
|
||||
"displayName": "user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_category",
|
||||
"displayName": "user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_priority",
|
||||
"displayName": "user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "All_Application_State_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The compute resource where the service is installed. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Application_State_fillnull_process",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of a process or service file, such as sqlsrvr.exe or httpd. Note: This field is not appropriate for service or daemon names, such as SQL Server or Apache Web Server. Service or daemon names belong to the service field.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "process",
|
||||
"displayName": "process",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(process) OR process=\"\",\"unknown\",process)"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Application_State_fillnull_process_name",
|
||||
"calculationType": "Rex",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of a process.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "process_name",
|
||||
"displayName": "process_name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"inputField": "process",
|
||||
"expression": "^\\s*(?<process_name>[^\\s]+)"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Application_State_indexes`) (tag=listening tag=port) OR (tag=process tag=report) OR (tag=service tag=report)"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"listening",
|
||||
"port"
|
||||
]
|
||||
},
|
||||
"objectName": "Ports",
|
||||
"displayName": "Ports",
|
||||
"parentName": "All_Application_State",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Ports_fillnull_dest_port",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Network ports communicated to by the process, such as 53.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest_port",
|
||||
"displayName": "dest_port",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnum(dest_port),dest_port,0)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Ports_fillnull_transport",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The network ports listened to by the application process, such as tcp, udp, etc.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "transport",
|
||||
"displayName": "transport",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(transport) OR transport=\"\",\"unknown\",lower(transport))"
|
||||
},
|
||||
{
|
||||
"calculationID": "Ports_transport_dest_port",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Calculated as transport\/dest_port, such as tcp\/53.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "transport_dest_port",
|
||||
"displayName": "transport_dest_port",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(transport_dest_port) OR transport_dest_port=\"\",split(replace(mvjoin(mvzip(transport,dest_port),\"|\"),\",\",\"\/\"),\"|\"),transport_dest_port)"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=listening tag=port"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"process",
|
||||
"report"
|
||||
]
|
||||
},
|
||||
"objectName": "Processes",
|
||||
"displayName": "Processes",
|
||||
"parentName": "All_Application_State",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "CPU Load in megahertz."
|
||||
},
|
||||
"fieldName": "cpu_load_mhz",
|
||||
"displayName": "cpu_load_mhz",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "CPU Load in percent."
|
||||
},
|
||||
"fieldName": "cpu_load_percent",
|
||||
"displayName": "cpu_load_percent",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "CPU Time."
|
||||
},
|
||||
"fieldName": "cpu_time",
|
||||
"displayName": "cpu_time",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Memory used in bytes."
|
||||
},
|
||||
"fieldName": "mem_used",
|
||||
"displayName": "mem_used",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=process tag=report"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"service",
|
||||
"report"
|
||||
]
|
||||
},
|
||||
"objectName": "Services",
|
||||
"displayName": "Services",
|
||||
"parentName": "All_Application_State",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Services_fillnull_service",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the service, such as SQL Server or Apache Web Server. Note: This field is not appropriate for filenames, such as sqlsrvr.exe or httpd. Filenames should belong to the process field instead. Also, note that field is a string. Use the service_id field for service ID fields that are integer data types.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "service",
|
||||
"displayName": "service",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(service) OR service=\"\",\"unknown\",service)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Services_fillnull_service_id",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "A numeric indicator for a service.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "service_id",
|
||||
"displayName": "service_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(service_id) OR service_id=\"\",\"unknown\",service_id)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Services_fillnull_start_mode",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The start mode for the service.",
|
||||
"expected_values": [
|
||||
"disabled",
|
||||
"manual",
|
||||
"auto"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "start_mode",
|
||||
"displayName": "start_mode",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(start_mode) OR start_mode=\"\",\"unknown\",start_mode)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Services_fillnull_status",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The status of the service.",
|
||||
"expected_values": [
|
||||
"critical",
|
||||
"started",
|
||||
"stopped",
|
||||
"warning"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "status",
|
||||
"displayName": "status",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(status) OR status=\"\",\"unknown\",status)"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=service tag=report"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,752 @@
|
||||
{
|
||||
"modelName": "Authentication",
|
||||
"displayName": "Authentication",
|
||||
"description": "Authentication Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"authentication"
|
||||
]
|
||||
},
|
||||
"objectName": "Authentication",
|
||||
"displayName": "Authentication",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The method used to authenticate the request such as SAML, FIDO, or MFA."
|
||||
},
|
||||
"fieldName": "authentication_method",
|
||||
"displayName": "authentication_method",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The service used to authenticate the request such as Okta, or ActiveDirectory"
|
||||
},
|
||||
"fieldName": "authentication_service",
|
||||
"displayName": "authentication_service",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the authentication target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the authentication target, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the Active Directory used by the authentication target, if applicable."
|
||||
},
|
||||
"fieldName": "dest_nt_domain",
|
||||
"displayName": "dest_nt_domain",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the authentication target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of time for the completion of the authentication event, in seconds."
|
||||
},
|
||||
"fieldName": "duration",
|
||||
"displayName": "duration",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The human-readable message associated with the authentication action (success or failure)."
|
||||
},
|
||||
"fieldName": "reason",
|
||||
"displayName": "reason",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of time it took to receive a response in the authentication event, in seconds."
|
||||
},
|
||||
"fieldName": "response_time",
|
||||
"displayName": "response_time",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "A human-readable signature name."
|
||||
},
|
||||
"fieldName": "signature",
|
||||
"displayName": "signature",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique identifier or event code of the event signature."
|
||||
},
|
||||
"fieldName": "signature_id",
|
||||
"displayName": "signature_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the authentication source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_bunit",
|
||||
"displayName": "src_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the authentication source, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_category",
|
||||
"displayName": "src_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the Active Directory used by the authentication source, if applicable."
|
||||
},
|
||||
"fieldName": "src_nt_domain",
|
||||
"displayName": "src_nt_domain",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the authentication source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_priority",
|
||||
"displayName": "src_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_user_bunit",
|
||||
"displayName": "src_user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_user_category",
|
||||
"displayName": "src_user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed."
|
||||
},
|
||||
"fieldName": "src_user_id",
|
||||
"displayName": "src_user_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_user_priority",
|
||||
"displayName": "src_user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The role of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed."
|
||||
},
|
||||
"fieldName": "src_user_role",
|
||||
"displayName": "src_user_role",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The type of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed."
|
||||
},
|
||||
"fieldName": "src_user_type",
|
||||
"displayName": "src_user_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user agent through which the request was made, such as Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) or aws-cli/2.0.0 Python/3.7.4 Darwin/18.7.0 botocore/2.0.0dev4."
|
||||
},
|
||||
"fieldName": "user_agent",
|
||||
"displayName": "user_agent",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the user involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_bunit",
|
||||
"displayName": "user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the user involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_category",
|
||||
"displayName": "user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique id of the user involved in the event. For authentication privilege escalation events, this should represent the user targeted by the escalation."
|
||||
},
|
||||
"fieldName": "user_id",
|
||||
"displayName": "user_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the user involved in the event, or who initiated the event. For authentication privilege escalation events, this should represent the user priority targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_priority",
|
||||
"displayName": "user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The role of the user involved in the event, or who initiated the event. For authentication privilege escalation events, this should represent the user role targeted by the escalation."
|
||||
},
|
||||
"fieldName": "user_role",
|
||||
"displayName": "user_role",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The type of the user involved in the event or who initiated the event, such as IAMUser, Admin, or System. For authentication privilege escalation events, this should represent the user type targeted by the escalation."
|
||||
},
|
||||
"fieldName": "user_type",
|
||||
"displayName": "user_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The account that manages the user that initiated the request."
|
||||
},
|
||||
"fieldName": "vendor_account",
|
||||
"displayName": "vendor_account",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Authentication_fillnull_action",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The action performed on the resource.",
|
||||
"expected_values": [
|
||||
"success",
|
||||
"failure",
|
||||
"pending",
|
||||
"error"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "action",
|
||||
"displayName": "action",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(action) OR action=\"\",\"unknown\",action)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Authentication_fillnull_app",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The application involved in the event, such as ssh, splunk, win:local.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "app",
|
||||
"displayName": "app",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(app) OR app=\"\",sourcetype,app)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Authentication_fillnull_src",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The source involved in the authentication. In the case of endpoint protection authentication the src is the client. You can alias this from more specific fields, such as src_host, src_ip, or src_nt_host.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "src",
|
||||
"displayName": "src",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(src) OR src=\"\",\"unknown\",src)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Authentication_fillnull_src_user",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "In privilege escalation events, src_user represents the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "src_user",
|
||||
"displayName": "src_user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(src_user) OR src_user=\"\",\"unknown\",src_user)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Authentication_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The target involved in the authentication. You can alias this from more specific fields, such as dest_host, dest_ip, dest_mac, or dest_nt_host.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Authentication_fillnull_user",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the user involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(user) OR user=\"\",\"unknown\",user)"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$)"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"authentication"
|
||||
]
|
||||
},
|
||||
"objectName": "Failed_Authentication",
|
||||
"displayName": "Failed Authentication",
|
||||
"parentName": "Authentication",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "action=\"failure\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"authentication"
|
||||
]
|
||||
},
|
||||
"objectName": "Successful_Authentication",
|
||||
"displayName": "Successful Authentication",
|
||||
"parentName": "Authentication",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "action=\"success\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"authentication",
|
||||
"default"
|
||||
]
|
||||
},
|
||||
"objectName": "Default_Authentication",
|
||||
"displayName": "Default Authentication",
|
||||
"parentName": "Authentication",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=\"default\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"authentication",
|
||||
"default"
|
||||
]
|
||||
},
|
||||
"objectName": "Failed_Default_Authentication",
|
||||
"displayName": "Failed Default Authentication",
|
||||
"parentName": "Default_Authentication",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "action=\"failure\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"authentication",
|
||||
"default"
|
||||
]
|
||||
},
|
||||
"objectName": "Successful_Default_Authentication",
|
||||
"displayName": "Successful Default Authentication",
|
||||
"parentName": "Default_Authentication",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "action=\"success\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"authentication",
|
||||
"insecure"
|
||||
]
|
||||
},
|
||||
"objectName": "Insecure_Authentication",
|
||||
"displayName": "Insecure Authentication",
|
||||
"parentName": "Authentication",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=\"insecure\" OR tag=\"cleartext\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"authentication",
|
||||
"privileged"
|
||||
]
|
||||
},
|
||||
"objectName": "Privileged_Authentication",
|
||||
"displayName": "Privileged Authentication",
|
||||
"parentName": "Authentication",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=\"privileged\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"authentication",
|
||||
"privileged"
|
||||
]
|
||||
},
|
||||
"objectName": "Failed_Privileged_Authentication",
|
||||
"displayName": "Failed Privileged Authentication",
|
||||
"parentName": "Privileged_Authentication",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "action=\"failure\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"authentication",
|
||||
"privileged"
|
||||
]
|
||||
},
|
||||
"objectName": "Successful_Privileged_Authentication",
|
||||
"displayName": "Successful Privileged Authentication",
|
||||
"parentName": "Privileged_Authentication",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "action=\"success\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,696 @@
|
||||
{
|
||||
"modelName": "Certificates",
|
||||
"displayName": "Certificates",
|
||||
"description": "Certificates Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"certificate"
|
||||
]
|
||||
},
|
||||
"objectName": "All_Certificates",
|
||||
"displayName": "All Certificates",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The target in the certificate management event."
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the target, such as email_server or SOX-compliant. This field is automatically provided by Asset and Identity correlation features of applications like the Splunk Enterprise Security.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The port number of the target."
|
||||
},
|
||||
"fieldName": "dest_port",
|
||||
"displayName": "dest_port",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the target.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of time for the completion of the certificate management event, in seconds."
|
||||
},
|
||||
"fieldName": "duration",
|
||||
"displayName": "duration",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of time it took, in seconds, to receive a response in the certificate management event, if applicable."
|
||||
},
|
||||
"fieldName": "response_time",
|
||||
"displayName": "response_time",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The source involved in the certificate management event. You can alias this from more specific fields, such as src_host, src_ip, or src_nt_host."
|
||||
},
|
||||
"fieldName": "src",
|
||||
"displayName": "src",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the certificate management source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_bunit",
|
||||
"displayName": "src_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the certificate management source, such as email_server or SOX-compliant. This field is automatically provided by Asset and Identity correlation features of applications like the Splunk Enterprise Security.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_category",
|
||||
"displayName": "src_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The port number of the source."
|
||||
},
|
||||
"fieldName": "src_port",
|
||||
"displayName": "src_port",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the certificate management source.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_priority",
|
||||
"displayName": "src_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The transport protocol of the Network Traffic involved with this certificate."
|
||||
},
|
||||
"fieldName": "transport",
|
||||
"displayName": "transport",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Certificates_indexes`) tag=certificate"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"certificate",
|
||||
"ssl"
|
||||
]
|
||||
},
|
||||
"objectName": "SSL",
|
||||
"displayName": "Transport Layer Security",
|
||||
"parentName": "All_Certificates",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The expiry time of the certificate.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "ssl_end_time",
|
||||
"displayName": "ssl_end_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the signature engine that created the certificate."
|
||||
},
|
||||
"fieldName": "ssl_engine",
|
||||
"displayName": "ssl_engine",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate issuer's email address."
|
||||
},
|
||||
"fieldName": "ssl_issuer_email",
|
||||
"displayName": "ssl_issuer_email",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate issuer's locality."
|
||||
},
|
||||
"fieldName": "ssl_issuer_locality",
|
||||
"displayName": "ssl_issuer_locality",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate issuer's state of residence."
|
||||
},
|
||||
"fieldName": "ssl_issuer_state",
|
||||
"displayName": "ssl_issuer_state",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate issuer's organization."
|
||||
},
|
||||
"fieldName": "ssl_issuer_organization",
|
||||
"displayName": "ssl_issuer_organization",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate issuer's organizational unit."
|
||||
},
|
||||
"fieldName": "ssl_issuer_unit",
|
||||
"displayName": "ssl_issuer_unit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate issuer's street address."
|
||||
},
|
||||
"fieldName": "ssl_issuer_street",
|
||||
"displayName": "ssl_issuer_street",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the ssl certificate."
|
||||
},
|
||||
"fieldName": "ssl_name",
|
||||
"displayName": "ssl_name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The Object Identification Numbers of the certificate's policies in a comma separated string."
|
||||
},
|
||||
"fieldName": "ssl_policies",
|
||||
"displayName": "ssl_policies",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate's public key."
|
||||
},
|
||||
"fieldName": "ssl_publickey",
|
||||
"displayName": "ssl_publickey",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The algorithm used to create the public key."
|
||||
},
|
||||
"fieldName": "ssl_publickey_algorithm",
|
||||
"displayName": "ssl_publickey_algorithm",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate's serial number.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "ssl_serial",
|
||||
"displayName": "ssl_serial",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The session identifier for this certificate."
|
||||
},
|
||||
"fieldName": "ssl_session_id",
|
||||
"displayName": "ssl_session_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The algorithm used by the Certificate Authority to sign the certificate."
|
||||
},
|
||||
"fieldName": "ssl_signature_algorithm",
|
||||
"displayName": "ssl_signature_algorithm",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This is the start date and time for this certificate's validity.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "ssl_start_time",
|
||||
"displayName": "ssl_start_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate owner's e-mail address."
|
||||
},
|
||||
"fieldName": "ssl_subject_email",
|
||||
"displayName": "ssl_subject_email",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate owner's locality."
|
||||
},
|
||||
"fieldName": "ssl_subject_locality",
|
||||
"displayName": "ssl_subject_locality",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate owner's state of residence."
|
||||
},
|
||||
"fieldName": "ssl_subject_state",
|
||||
"displayName": "ssl_subject_state",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate owner's organization."
|
||||
},
|
||||
"fieldName": "ssl_subject_organization",
|
||||
"displayName": "ssl_subject_organization",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate owner's organizational unit."
|
||||
},
|
||||
"fieldName": "ssl_subject_unit",
|
||||
"displayName": "ssl_subject_unit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate owner's street address."
|
||||
},
|
||||
"fieldName": "ssl_subject_street",
|
||||
"displayName": "ssl_subject_street",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The ssl version of this certificate."
|
||||
},
|
||||
"fieldName": "ssl_version",
|
||||
"displayName": "ssl_version",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "SSL_fillnull_ssl_hash",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The hash of the certificate.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "ssl_hash",
|
||||
"displayName": "ssl_hash",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(ssl_hash) OR ssl_hash=\"\",\"unknown\",ssl_hash)"
|
||||
},
|
||||
{
|
||||
"calculationID": "SSL_fillnull_ssl_issuer",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate issuer's RFC2253 Distinguished Name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "ssl_issuer",
|
||||
"displayName": "ssl_issuer",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(ssl_issuer) OR ssl_issuer=\"\",\"unknown\",ssl_issuer)"
|
||||
},
|
||||
{
|
||||
"calculationID": "SSL_fillnull_ssl_issuer_common_name",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate issuer's common name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "ssl_issuer_common_name",
|
||||
"displayName": "ssl_issuer_common_name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(ssl_issuer_common_name) OR ssl_issuer_common_name=\"\",\"unknown\",ssl_issuer_common_name)"
|
||||
},
|
||||
{
|
||||
"calculationID": "SSL_ssl_issuer_email_domain",
|
||||
"calculationType": "Rex",
|
||||
"inputField": "ssl_issuer_email",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The domain name contained within the certificate issuer's email address.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "ssl_issuer_email_domain",
|
||||
"displayName": "ssl_issuer_email_domain",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "^.*@(?<ssl_issuer_email_domain>.+)$"
|
||||
},
|
||||
{
|
||||
"calculationID": "SSL_fillnull_ssl_subject",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate owner's RFC2253 Distinguished Name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "ssl_subject",
|
||||
"displayName": "ssl_subject",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(ssl_subject) OR ssl_subject=\"\",\"unknown\",ssl_subject)"
|
||||
},
|
||||
{
|
||||
"calculationID": "SSL_fillnull_ssl_subject_common_name",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The certificate subject's common name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "ssl_subject_common_name",
|
||||
"displayName": "ssl_subject_common_name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(ssl_subject_common_name) OR ssl_subject_common_name=\"\",\"unknown\",ssl_subject_common_name)"
|
||||
},
|
||||
{
|
||||
"calculationID": "SSL_ssl_subject_email_domain",
|
||||
"calculationType": "Rex",
|
||||
"inputField": "ssl_subject_email",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The domain name contained within the certificate subject's email address.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "ssl_subject_email_domain",
|
||||
"displayName": "ssl_subject_email_domain",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "^.*@(?<ssl_subject_email_domain>.+)$"
|
||||
},
|
||||
{
|
||||
"calculationID": "SSL_0validity_window",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The length of time, in seconds, for which this certificate is valid.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "ssl_validity_window",
|
||||
"displayName": "ssl_validity_window",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnum(ssl_end_time) AND isnum(ssl_start_time),ssl_end_time-ssl_start_time,null())"
|
||||
},
|
||||
{
|
||||
"calculationID": "SSL_1is_valid",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Indicator of whether the ssl certificate is valid or not.",
|
||||
"expected_values": [
|
||||
"true",
|
||||
"false",
|
||||
"1",
|
||||
"0"
|
||||
],
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "ssl_is_valid",
|
||||
"displayName": "ssl_is_valid",
|
||||
"type": "boolean",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(match(ssl_is_valid, \"^(1|[Tt]|[Tt][Rr][Uu][Ee])$\"),1,match(ssl_is_valid, \"^(0|[Ff]|[Ff][Aa][Ll][Ss][Ee])$\"),0,isnum(ssl_end_time) AND isnum(ssl_start_time) AND _time>=ssl_start_time AND _time<=ssl_end_time,1,isnum(ssl_end_time) AND isnum(ssl_start_time),0,1=1,null())"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(tag=ssl OR tag=tls)"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,591 @@
|
||||
{
|
||||
"modelName": "DLP",
|
||||
"displayName": "Data Loss Prevention",
|
||||
"description": "Data Loss Prevention Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"dlp",
|
||||
"incident"
|
||||
]
|
||||
},
|
||||
"objectName": "DLP_Incidents",
|
||||
"displayName": "DLP Incidents",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The application involved in the event."
|
||||
},
|
||||
"fieldName": "app",
|
||||
"displayName": "app",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The zone of the DLP target."
|
||||
},
|
||||
"fieldName": "dest_zone",
|
||||
"displayName": "dest_zone",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dvc_bunit",
|
||||
"displayName": "dvc_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dvc_category",
|
||||
"displayName": "dvc_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dvc_priority",
|
||||
"displayName": "dvc_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The zone of the DLP device."
|
||||
},
|
||||
"fieldName": "dvc_zone",
|
||||
"displayName": "dvc_zone",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The numeric or vendor specific severity indicator corresponding to the event severity."
|
||||
},
|
||||
"fieldName": "severity_id",
|
||||
"displayName": "severity_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique identifier or event code of the event signature."
|
||||
},
|
||||
"fieldName": "signature_id",
|
||||
"displayName": "signature_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_bunit",
|
||||
"displayName": "src_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_category",
|
||||
"displayName": "src_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_priority",
|
||||
"displayName": "src_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The zone of the DLP source."
|
||||
},
|
||||
"fieldName": "src_zone",
|
||||
"displayName": "src_zone",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_user_bunit",
|
||||
"displayName": "src_user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_user_category",
|
||||
"displayName": "src_user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_user_priority",
|
||||
"displayName": "src_user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_bunit",
|
||||
"displayName": "user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_category",
|
||||
"displayName": "user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_priority",
|
||||
"displayName": "user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "DLP_Incidents_fillnull_action",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The action taken by the DLP device.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "action",
|
||||
"displayName": "action",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(action) OR action=\"\",\"unknown\",action)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_Incidents_fillnull_category",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the DLP event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "category",
|
||||
"displayName": "category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_Incidents_fillnull_dvc",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The device that reported the DLP event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dvc",
|
||||
"displayName": "dvc",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_incidents_fillnull_dlp_type",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The type of DLP system that generated the event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dlp_type",
|
||||
"displayName": "dlp_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dlp_type) OR dlp_type=\"\",\"unknown\",dlp_type)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_Incidents_fillnull_object",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the affected object.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "object",
|
||||
"displayName": "object",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(object) OR object=\"\",\"unknown\",object)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_Incidents_fillnull_object_path",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The path of the affected object.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "object_path",
|
||||
"displayName": "object_path",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(object_path) OR object_path=\"\",\"unknown\",object_path)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_Incidents_fillnull_object_category",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the affected object.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "object_category",
|
||||
"displayName": "object_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_Incidents_fillnull_signature",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the DLP event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "signature",
|
||||
"displayName": "signature",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_Incidents_fillnull_severity",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The severity of the DLP event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "severity",
|
||||
"displayName": "severity",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_Incidents_fillnull_src",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The source of the DLP event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "src",
|
||||
"displayName": "src",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(src) OR src=\"\",\"unknown\",src)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_Incidents_fillnull_src_user",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The source user of the DLP event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "src_user",
|
||||
"displayName": "src_user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(src_user) OR user=\"\",\"unknown\",src_user)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_Incidents_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The target of the DLP event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_Incidents_fillnull_user",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The target user of the DLP event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(user) OR user=\"\",\"unknown\",user)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DLP_Incidents_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor and product name of the DLP system.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_DLP_indexes`) tag=dlp tag=incident"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,463 @@
|
||||
{
|
||||
"modelName": "Data_Access",
|
||||
"displayName": "Data Access",
|
||||
"description": "Data Access Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"data",
|
||||
"access"
|
||||
]
|
||||
},
|
||||
"objectName": "Data_Access",
|
||||
"displayName": "Data Access",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Application ID of the user"
|
||||
},
|
||||
"fieldName": "application_id",
|
||||
"displayName": "application_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Name of the destination as defined by the Vendor."
|
||||
},
|
||||
"fieldName": "dest_name",
|
||||
"displayName": "dest_name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Url of the product, application or object."
|
||||
},
|
||||
"fieldName": "dest_url",
|
||||
"displayName": "dest_url",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The device that reported the data access event."
|
||||
},
|
||||
"fieldName": "dvc",
|
||||
"displayName": "dvc",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The email address of the user involved in the event, or who initiated the event."
|
||||
},
|
||||
"fieldName": "email",
|
||||
"displayName": "email",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The path of the modified resource object, if applicable, such as a file, directory, or volume."
|
||||
},
|
||||
"fieldName": "object_path",
|
||||
"displayName": "object_path",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Resource owner."
|
||||
},
|
||||
"fieldName": "owner",
|
||||
"displayName": "owner",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "ID of the owner as defined by the vendor."
|
||||
},
|
||||
"fieldName": "owner_id",
|
||||
"displayName": "owner_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Email of the resource owner."
|
||||
},
|
||||
"fieldName": "owner_email",
|
||||
"displayName": "owner_email",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Parent of the object name on which the action was performed by a user."
|
||||
},
|
||||
"fieldName": "parent_object",
|
||||
"displayName": "parent_object",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Object category of the parent object on which action was performed by a user."
|
||||
},
|
||||
"fieldName": "parent_object_category",
|
||||
"displayName": "parent_object_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Object id of the parent object on which the action was performed by a user."
|
||||
},
|
||||
"fieldName": "parent_object_id",
|
||||
"displayName": "parent_object_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user agent through which the request was made, such as Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) or aws-cli/2.0.0 Python/3.7.4 Darwin/18.7.0 botocore/2.0.0dev4."
|
||||
},
|
||||
"fieldName": "user_agent",
|
||||
"displayName": "user_agent",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The group of the user involved in the event, or who initiated the event."
|
||||
},
|
||||
"fieldName": "user_group",
|
||||
"displayName": "user_group",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The role of the user involved in the event, or who initiated the event."
|
||||
},
|
||||
"fieldName": "user_role",
|
||||
"displayName": "user_role",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor and product name ID as defined by the vendor."
|
||||
},
|
||||
"fieldName": "vendor_product_id",
|
||||
"displayName": "vendor_product_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Data_Access_fillnull_action",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The data access action taken by the user.",
|
||||
"expected_values": [
|
||||
"copied",
|
||||
"created",
|
||||
"deleted",
|
||||
"modified",
|
||||
"read",
|
||||
"stopped",
|
||||
"updated",
|
||||
"downloaded",
|
||||
"uploaded",
|
||||
"shared"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "action",
|
||||
"displayName": "action",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(action) OR action=\"\",\"unknown\",action)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Data_Access_fillnull_app",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The system, service, or application that generated the data access event. Examples include Onedrive, Sharepoint, drive, AzureActiveDirectory.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "app",
|
||||
"displayName": "app",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(app) OR app=\"\",sourcetype,app)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Data_Access_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The destination where the data resides or where it is being accessed, such as the product or application. You can alias this from more specific fields not included in this data model, such as dest_host, dest_ip, dest_url or dest_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Data_Access_fillnull_object",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Resource object name on which the action was performed by a user.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "object",
|
||||
"displayName": "object",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(object) OR object=\"\",\"unknown\",object)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Data_Access_fillnull_object_category",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Generic name for the class of the updated resource object. Expected values may be specific to an app.",
|
||||
"expected_values": [
|
||||
"collaboration",
|
||||
"file",
|
||||
"folder",
|
||||
"comment",
|
||||
"task",
|
||||
"note"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "object_category",
|
||||
"displayName": "object_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Data_Access_fillnull_object_id",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique updated resource object ID as presented to the system, if applicable. For example, a source_folder_id, doc_id.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "object_id",
|
||||
"displayName": "object_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(object_id) OR object_id=\"\",\"unknown\",object_id)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Data_Access_fillnull_object_size",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The size of the modified resource object.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "object_size",
|
||||
"displayName": "object_size",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(object_size) OR object_size=\"\",\"unknown\",object_size)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Data_Access_fillnull_src",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The endpoint client host.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "src",
|
||||
"displayName": "src",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(src) OR src=\"\",\"unknown\",src)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Data_Access_fillnull_vendor_account",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The account that manages the user that initiated the request.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_account",
|
||||
"displayName": "vendor_account",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(vendor_account) OR vendor_account=\"\",\"unknown\",vendor_account)"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Changes_fillnull_user",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user involved in the event, or who initiated the event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(user) OR user=\"\",\"unknown\",user)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Data_Access_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor and product name of the vendor.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Data_Access_indexes`) tag=data tag=access"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,825 @@
|
||||
{
|
||||
"modelName": "Email",
|
||||
"displayName": "Email",
|
||||
"description": "Email Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"email"
|
||||
]
|
||||
},
|
||||
"objectName": "All_Email",
|
||||
"displayName": "All Email",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Total sending delay in milliseconds."
|
||||
},
|
||||
"displayName": "delay",
|
||||
"fieldName": "delay",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the endpoint system to which the message was delivered. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the endpoint system to which the message was delivered. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the endpoint system to which the message was delivered. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of time for the completion of the messaging event, in seconds."
|
||||
},
|
||||
"fieldName": "duration",
|
||||
"displayName": "duration",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The hashes for the files attached to the message, if any exist."
|
||||
},
|
||||
"displayName": "file_hash",
|
||||
"fieldName": "file_hash",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The names of the files attached to the message, if any exist."
|
||||
},
|
||||
"displayName": "file_name",
|
||||
"fieldName": "file_name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The size of the files attached the message, in bytes."
|
||||
},
|
||||
"displayName": "file_size",
|
||||
"fieldName": "file_size",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Host-specific unique message identifier (such as aid in sendmail, IMI in Domino, Internal-Message-ID in Exchange, and MID in Ironport)."
|
||||
},
|
||||
"displayName": "internal_message_id",
|
||||
"fieldName": "internal_message_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The globally-unique message identifier."
|
||||
},
|
||||
"displayName": "message_id",
|
||||
"fieldName": "message_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Additional information about the message."
|
||||
},
|
||||
"displayName": "message_info",
|
||||
"fieldName": "message_info",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The original destination host of the message. The message destination host can change when a message is relayed or bounced."
|
||||
},
|
||||
"displayName": "orig_dest",
|
||||
"fieldName": "orig_dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The original recipient of the message. The message recipient can change when the original email address is an alias and has to be resolved to the actual recipient."
|
||||
},
|
||||
"displayName": "orig_recipient",
|
||||
"fieldName": "orig_recipient",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The original source of the message."
|
||||
},
|
||||
"displayName": "orig_src",
|
||||
"fieldName": "orig_src",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The email protocol involved, such as SMTP or RPC.",
|
||||
"expected_values": [
|
||||
"smtp",
|
||||
"imap",
|
||||
"pop3",
|
||||
"mapi"
|
||||
]
|
||||
},
|
||||
"displayName": "protocol",
|
||||
"fieldName": "protocol",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the email executable that carries out the message transaction, such as sendmail, postfix, or the name of an email client."
|
||||
},
|
||||
"fieldName": "process",
|
||||
"displayName": "process",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The numeric identifier of the process invoked to send the message."
|
||||
},
|
||||
"fieldName": "process_id",
|
||||
"displayName": "process_id",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The recipient delivery status, if available."
|
||||
},
|
||||
"displayName": "recipient_status",
|
||||
"fieldName": "recipient_status",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of time it took to receive a response in the messaging event, in seconds."
|
||||
},
|
||||
"fieldName": "response_time",
|
||||
"displayName": "response_time",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The number of times that the message was automatically resent because it was bounced back, or a similar transmission error condition."
|
||||
},
|
||||
"displayName": "retries",
|
||||
"fieldName": "retries",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The return address for the message."
|
||||
},
|
||||
"displayName": "return_addr",
|
||||
"fieldName": "return_addr",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The size of the message, in bytes."
|
||||
},
|
||||
"displayName": "size",
|
||||
"fieldName": "size",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the system that sent the message. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_bunit",
|
||||
"displayName": "src_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the system that sent the message. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_category",
|
||||
"displayName": "src_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the system that sent the message. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_priority",
|
||||
"displayName": "src_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the message sender. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_user_bunit",
|
||||
"displayName": "src_user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the message sender. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_user_category",
|
||||
"displayName": "src_user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the message sender. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_user_priority",
|
||||
"displayName": "src_user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The status code associated with the message."
|
||||
},
|
||||
"displayName": "status_code",
|
||||
"fieldName": "status_code",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The subject of the message."
|
||||
},
|
||||
"displayName": "subject",
|
||||
"fieldName": "subject",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The URL associated with the message, if any."
|
||||
},
|
||||
"displayName": "url",
|
||||
"fieldName": "url",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user context for the process. This is not the email address for the sender. For that, use the src_user field."
|
||||
},
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the user context for the process. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_bunit",
|
||||
"displayName": "user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the user context for the process. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_category",
|
||||
"displayName": "user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the user context for the process. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_priority",
|
||||
"displayName": "user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Extended delay information for the message transaction. May contain details of all the delays from all the servers in the message transmission chain."
|
||||
},
|
||||
"displayName": "xdelay",
|
||||
"fieldName": "xdelay",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "An external reference. Can contain message IDs or recipient addresses from related messages."
|
||||
},
|
||||
"displayName": "xref",
|
||||
"fieldName": "xref",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Email_fillnull_action",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Action taken by the reporting device.",
|
||||
"expected_values": [
|
||||
"delivered",
|
||||
"blocked",
|
||||
"quarantined",
|
||||
"deleted"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "action",
|
||||
"displayName": "action",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(action) OR action=\"\",\"unknown\",action)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Email_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The endpoint system to which the message was delivered. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Email_fillnull_src",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The system that sent the message. You can alias this from more specific fields, such as src_host, src_ip, or src_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "src",
|
||||
"displayName": "src",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(src) OR src=\"\",\"unknown\",src)"
|
||||
},
|
||||
{
|
||||
"calculationID": "0Email_fillnull_recipient",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The recipient email addresses.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "recipient",
|
||||
"displayName": "recipient",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(recipient) OR recipient=\"\",\"unknown\",recipient)"
|
||||
},
|
||||
{
|
||||
"calculationID": "1Email_recipient_domain",
|
||||
"calculationType": "Rex",
|
||||
"inputField": "recipient",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The domain name contained within the recipient email addresses.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "recipient_domain",
|
||||
"displayName": "recipient_domain",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "^.*@(?<recipient_domain>.+)$"
|
||||
},
|
||||
{
|
||||
"calculationID": "2Email_recipient_count",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The total number of intended message recipients.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "recipient_count",
|
||||
"displayName": "recipient_count",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnum(recipient_count),recipient_count,isnotnull(recipient),mvcount(recipient),1=1,1)"
|
||||
},
|
||||
{
|
||||
"calculationID": "0Email_fillnull_src_user",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The email address of the message sender.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "src_user",
|
||||
"displayName": "src_user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(src_user) OR src_user=\"\",\"unknown\",src_user)"
|
||||
},
|
||||
{
|
||||
"calculationID": "1Email_src_user_domain",
|
||||
"calculationType": "Rex",
|
||||
"inputField": "src_user",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The domain name contained within the email address of the message sender.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "src_user_domain",
|
||||
"displayName": "src_user_domain",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "^.*@(?<src_user_domain>.+)$"
|
||||
},
|
||||
{
|
||||
"calculationID": "Email_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor and product of the email server used for the email transaction. This field can be automatically populated by vendor and product fields in your data.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Email_indexes`) tag=email"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"email",
|
||||
"delivery"
|
||||
]
|
||||
},
|
||||
"objectName": "Delivery",
|
||||
"displayName": "Email Delivery",
|
||||
"parentName": "All_Email",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=delivery"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"email",
|
||||
"content"
|
||||
]
|
||||
},
|
||||
"objectName": "Content",
|
||||
"displayName": "Email Content",
|
||||
"parentName": "All_Email",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=content"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"email",
|
||||
"filter"
|
||||
]
|
||||
},
|
||||
"objectName": "Filtering",
|
||||
"displayName": "Email Filtering",
|
||||
"parentName": "All_Email",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The status produced by the filter, such as 'accepted', 'rejected', or 'dropped'."
|
||||
},
|
||||
"displayName": "filter_action",
|
||||
"fieldName": "filter_action",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Numeric indicator assigned to specific emails by an email filter."
|
||||
},
|
||||
"displayName": "filter_score",
|
||||
"fieldName": "filter_score",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the filter applied.",
|
||||
"recommended": true
|
||||
},
|
||||
"displayName": "signature",
|
||||
"fieldName": "signature",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Any additional information about the filter."
|
||||
},
|
||||
"displayName": "signature_extra",
|
||||
"fieldName": "signature_extra",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The id associated with the filter name."
|
||||
},
|
||||
"displayName": "signature_id",
|
||||
"fieldName": "signature_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=filter"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,136 @@
|
||||
{
|
||||
"modelName": "Event_Signatures",
|
||||
"displayName": "Event Signatures",
|
||||
"description": "Event Signatures Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"track_event_signatures"
|
||||
]
|
||||
},
|
||||
"objectName": "Signatures",
|
||||
"displayName": "Signatures",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "System affected by the signature."
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The human readable event name."
|
||||
},
|
||||
"fieldName": "signature",
|
||||
"displayName": "signature",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The event name identifier (as supplied by the vendor)."
|
||||
},
|
||||
"fieldName": "signature_id",
|
||||
"displayName": "signature_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Signatures_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor and product name of the technology that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Event_Signatures_indexes`) tag=track_event_signatures (signature=* OR signature_id=*)"
|
||||
}
|
||||
],
|
||||
"children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,462 @@
|
||||
{
|
||||
"objectNameList": [
|
||||
|
||||
],
|
||||
"objectSummary": {
|
||||
|
||||
},
|
||||
"displayName": "Interprocess Messaging",
|
||||
"description": "",
|
||||
"modelName": "Interprocess_Messaging",
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"messaging"
|
||||
]
|
||||
},
|
||||
"objectName": "All_Messaging",
|
||||
"displayName": "All Interprocess Messaging",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the destination.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The type of message destination.",
|
||||
"expected_values": [
|
||||
"queue",
|
||||
"topic"
|
||||
],
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the destination.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The number of seconds from message call to message response. Can be derived by getting the difference between the request_sent_time and the message_received_time."
|
||||
},
|
||||
"fieldName": "duration",
|
||||
"displayName": "duration",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The endpoint that the message accessed during the RPC (remote procedure call) transaction."
|
||||
},
|
||||
"fieldName": "endpoint",
|
||||
"displayName": "endpoint",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The version of the endpoint accessed during the RPC (remote procedure call) transaction, such as 1.0 or 1.22."
|
||||
},
|
||||
"fieldName": "endpoint_version",
|
||||
"displayName": "endpoint_version",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The message identification."
|
||||
},
|
||||
"fieldName": "message_id",
|
||||
"displayName": "message_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "A command or reference that an RPC (remote procedure call) reads or responds to."
|
||||
},
|
||||
"fieldName": "message",
|
||||
"displayName": "message",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The time that the RPC (remote procedure call) read the message and was prepared to take some sort of action."
|
||||
},
|
||||
"fieldName": "message_consumed_time",
|
||||
"displayName": "message_consumed_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The message correlation identification value."
|
||||
},
|
||||
"fieldName": "message_correlation_id",
|
||||
"displayName": "message_correlation_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The time that the message producer sent the message."
|
||||
},
|
||||
"fieldName": "message_delivered_time",
|
||||
"displayName": "message_delivered_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The message delivery mode. Possible values depend on the type of message-oriented middleware (MOM) solution in use. They can be words like Transient (meaning the message is stored in memory and is lost if the server dies or restarts) or Persistent (meaning the message is stored both in memory and on disk and is preserved if the server dies or restarts). They can also be numbers like 1, 2, and so on."
|
||||
},
|
||||
"fieldName": "message_delivery_mode",
|
||||
"displayName": "message_delivery_mode",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The time that the message expired."
|
||||
},
|
||||
"fieldName": "message_expiration_time",
|
||||
"displayName": "message_expiration_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the message. Important jobs that the message queue should answer no matter what receive a higher message_priority than other jobs, ensuring they are completed before the others."
|
||||
},
|
||||
"fieldName": "message_priority",
|
||||
"displayName": "message_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The time that the message was received by a message-oriented middleware (MOM) solution."
|
||||
},
|
||||
"fieldName": "message_received_time",
|
||||
"displayName": "message_received_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Indicates whether or not the message was redelivered."
|
||||
},
|
||||
"fieldName": "message_redelivered",
|
||||
"displayName": "message_redelivered",
|
||||
"type": "boolean",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the destination for replies to the message."
|
||||
},
|
||||
"fieldName": "message_reply_dest",
|
||||
"displayName": "message_reply_dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The type of message, such as call or reply."
|
||||
},
|
||||
"fieldName": "message_type",
|
||||
"displayName": "message_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "An arbitrary list of message properties. The set of properties displayed depends on the message-oriented middleware (MOM) solution that you are using."
|
||||
},
|
||||
"fieldName": "message_properties",
|
||||
"displayName": "message_properties",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Arguments that have been passed to an endpoint by a REST call or something similar. A sample parameter could be something like foo=bar."
|
||||
},
|
||||
"fieldName": "parameters",
|
||||
"displayName": "parameters",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The message payload."
|
||||
},
|
||||
"fieldName": "payload",
|
||||
"displayName": "payload",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The type of payload in the message. The payload type can be text (such as json, xml, and raw) or binary (such as compressed, object, encrypted, and image)."
|
||||
},
|
||||
"fieldName": "payload_type",
|
||||
"displayName": "payload_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The content of the message request."
|
||||
},
|
||||
"fieldName": "request_payload",
|
||||
"displayName": "request_payload",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The type of payload in the message request. The payload type can be text (such as json, xml, and raw) or binary (such as compressed, object, encrypted, and image)."
|
||||
},
|
||||
"fieldName": "request_payload_type",
|
||||
"displayName": "request_payload_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The time that the message request was sent."
|
||||
},
|
||||
"fieldName": "request_sent_time",
|
||||
"displayName": "request_sent_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The response status code sent by the receiving server. Ranges between 200 and 404."
|
||||
},
|
||||
"fieldName": "response_code",
|
||||
"displayName": "response_code",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The time that the message response was received."
|
||||
},
|
||||
"fieldName": "response_received_time",
|
||||
"displayName": "response_received_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of time it took to receive a response, in seconds."
|
||||
},
|
||||
"fieldName": "response_time",
|
||||
"displayName": "response_time",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The type of payload in the message response. The payload type can be text (such as json, xml, and raw) or binary (such as compressed, object, encrypted, and image)."
|
||||
},
|
||||
"fieldName": "response_payload_type",
|
||||
"displayName": "response_payload_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The response status message sent by the message server."
|
||||
},
|
||||
"fieldName": "return_message",
|
||||
"displayName": "return_message",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The protocol that the message server uses for remote procedure calls (RPC). Possible values include HTTP REST, SOAP, and EJB."
|
||||
},
|
||||
"fieldName": "rpc_protocol",
|
||||
"displayName": "rpc_protocol",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The status of the message response.",
|
||||
"expected_values": [
|
||||
"pass",
|
||||
"fail"
|
||||
]
|
||||
},
|
||||
"fieldName": "status",
|
||||
"displayName": "status",
|
||||
"type": "boolean",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "All_interprocess_messaging_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The destination of the message. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name."
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Interprocess_Messaging_indexes`) tag=messaging"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,583 @@
|
||||
{
|
||||
"modelName": "Intrusion_Detection",
|
||||
"displayName": "Intrusion Detection",
|
||||
"description": "Intrusion Detection Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"ids",
|
||||
"attack"
|
||||
]
|
||||
},
|
||||
"objectName": "IDS_Attacks",
|
||||
"displayName": "IDS Attacks",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The action taken by the intrusion detection system (IDS).",
|
||||
"expected_values": [
|
||||
"allowed",
|
||||
"blocked"
|
||||
]
|
||||
},
|
||||
"fieldName": "action",
|
||||
"displayName": "action",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The destination port of the intrusion."
|
||||
},
|
||||
"fieldName": "dest_port",
|
||||
"displayName": "dest_port",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dvc_bunit",
|
||||
"displayName": "dvc_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dvc_category",
|
||||
"displayName": "dvc_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dvc_priority",
|
||||
"displayName": "dvc_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "A cryptographic identifier assigned to the file object affected by the event.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "file_hash",
|
||||
"displayName": "file_hash",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the file, such as notepad.exe.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "file_name",
|
||||
"displayName": "file_name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The path of the file, such as C:\\Windows\\System32\\notepad.exe.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "file_path",
|
||||
"displayName": "file_path",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The numeric or vendor specific severity indicator corresponding to the event severity."
|
||||
},
|
||||
"fieldName": "severity_id",
|
||||
"displayName": "severity_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique identifier or event code of the event signature."
|
||||
},
|
||||
"fieldName": "signature_id",
|
||||
"displayName": "signature_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_bunit",
|
||||
"displayName": "src_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_category",
|
||||
"displayName": "src_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The port number of the source."
|
||||
},
|
||||
"fieldName": "src_port",
|
||||
"displayName": "src_port",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_priority",
|
||||
"displayName": "src_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The OSI layer 4 (transport) protocol of the intrusion, in lower case."
|
||||
},
|
||||
"fieldName": "transport",
|
||||
"displayName": "transport",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_bunit",
|
||||
"displayName": "user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_category",
|
||||
"displayName": "user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_priority",
|
||||
"displayName": "user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "IDS_Attacks_fillnull_dvc",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The device that detected the intrusion event. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dvc",
|
||||
"displayName": "dvc",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)"
|
||||
},
|
||||
{
|
||||
"calculationID": "IDS_Attacks_fillnull_ids_type",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The type of IDS that generated the event.",
|
||||
"expected_values": [
|
||||
"network",
|
||||
"host",
|
||||
"application",
|
||||
"wireless"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "ids_type",
|
||||
"displayName": "ids_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(ids_type) OR ids_type=\"\",\"unknown\",ids_type)"
|
||||
},
|
||||
{
|
||||
"calculationID": "IDS_Attacks_fillnull_category",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor-provided category of the triggered signature, such as spyware. Note: This field is a string. Use a category_id field for category ID fields that are integer data types (category_id fields are optional, so they are not included in this table).",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "category",
|
||||
"displayName": "category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(category) OR category=\"\",\"unknown\",category)"
|
||||
},
|
||||
{
|
||||
"calculationID": "IDS_Attacks_fillnull_signature",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the intrusion detected on the client (the src), such as PlugAndPlay_BO and JavaScript_Obfuscation_Fre. Note: This is a string value. Use signature_id for numeric indicators. The signature_id field is optional, so it is not included in the model.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "signature",
|
||||
"displayName": "signature",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)"
|
||||
},
|
||||
{
|
||||
"calculationID": "IDS_Attacks_fillnull_severity",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The severity of the network protection event. Note: This field is a string. Use severity_id for severity ID fields that are integer data types. The severity_id field is optional, so it is not included in the model. Also, specific values are required for this field. Use vendor_severity for the vendor's own human readable severity strings, such as Good, Bad, and Really Bad.",
|
||||
"expected_values": [
|
||||
"critical",
|
||||
"high",
|
||||
"medium",
|
||||
"low",
|
||||
"informational"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "severity",
|
||||
"displayName": "severity",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)"
|
||||
},
|
||||
{
|
||||
"calculationID": "IDS_Attacks_fillnull_src",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The source involved in the attack detected by the IDS. You can alias this from more specific fields, such as src_host, src_ip, or src_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "src",
|
||||
"displayName": "src",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(src) OR src=\"\",\"unknown\",src)"
|
||||
},
|
||||
{
|
||||
"calculationID": "IDS_Attacks_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The destination of the attack detected by the intrusion detection system (IDS). You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "IDS_Attacks_fillnull_user",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user involved with the intrusion detection event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(user) OR user=\"\",\"unknown\",user)"
|
||||
},
|
||||
{
|
||||
"calculationID": "IDS_Attacks_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor and product name of the IDS or IPS system that detected the vulnerability, such as HP Tipping Point. This field can be automatically populated by vendor and product fields in your data.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Intrusion_Detection_indexes`) tag=ids tag=attack"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"ids",
|
||||
"attack"
|
||||
]
|
||||
},
|
||||
"objectName": "Application_IDS_Attacks",
|
||||
"displayName": "Application Intrusion Detection",
|
||||
"parentName": "IDS_Attacks",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "ids_type=\"application\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"ids",
|
||||
"attack"
|
||||
]
|
||||
},
|
||||
"objectName": "Host_IDS_Attacks",
|
||||
"displayName": "Host Intrusion Detection",
|
||||
"parentName": "IDS_Attacks",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "ids_type=\"host\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"ids",
|
||||
"attack"
|
||||
]
|
||||
},
|
||||
"objectName": "Network_IDS_Attacks",
|
||||
"displayName": "Network Intrusion Detection",
|
||||
"parentName": "IDS_Attacks",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "ids_type=\"network\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,824 @@
|
||||
{
|
||||
"modelName": "JVM",
|
||||
"displayName": "JVM",
|
||||
"description": "Java Virtual Machine Data Model",
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"jvm"
|
||||
]
|
||||
},
|
||||
"objectName": "JVM",
|
||||
"displayName": "JVM",
|
||||
"parentName": "BaseEvent",
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_JVM_indexes`) tag=jvm"
|
||||
}
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "A description field provided in some data sources."
|
||||
},
|
||||
"fieldName": "jvm_description",
|
||||
"displayName": "jvm_description",
|
||||
"type": "string",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"jvm",
|
||||
"threading"
|
||||
]
|
||||
},
|
||||
"objectName": "Threading",
|
||||
"displayName": "Threading",
|
||||
"parentName": "JVM",
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=threading"
|
||||
}
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The total number of threads started in the JVM."
|
||||
},
|
||||
"fieldName": "threads_started",
|
||||
"displayName": "threads_started",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Indicates whether thread CPU time measurement is enabled.",
|
||||
"expected_values": [
|
||||
"true",
|
||||
"false",
|
||||
"1",
|
||||
"0"
|
||||
]
|
||||
},
|
||||
"fieldName": "cpu_time_enabled",
|
||||
"displayName": "cpu_time_enabled",
|
||||
"type": "boolean",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The JVM's current thread count."
|
||||
},
|
||||
"fieldName": "thread_count",
|
||||
"displayName": "thread_count",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Indicates whether the JVM supports thread contention monitoring.",
|
||||
"expected_values": [
|
||||
"true",
|
||||
"false",
|
||||
"1",
|
||||
"0"
|
||||
]
|
||||
},
|
||||
"fieldName": "cm_supported",
|
||||
"displayName": "cm_supported",
|
||||
"type": "boolean",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Indicates whether thread contention monitoring is enabled.",
|
||||
"expected_values": [
|
||||
"true",
|
||||
"false",
|
||||
"1",
|
||||
"0"
|
||||
]
|
||||
},
|
||||
"fieldName": "cm_enabled",
|
||||
"displayName": "cm_enabled",
|
||||
"type": "boolean",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Indicates whether the JVM supports monitoring of ownable synchronizer usage.",
|
||||
"expected_values": [
|
||||
"true",
|
||||
"false",
|
||||
"1",
|
||||
"0"
|
||||
]
|
||||
},
|
||||
"fieldName": "synch_supported",
|
||||
"displayName": "synch_supported",
|
||||
"type": "boolean",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The JVM's peak thread count."
|
||||
},
|
||||
"fieldName": "peak_thread_count",
|
||||
"displayName": "peak_thread_count",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Indicates whether the JVM supports monitoring of object monitor usage.",
|
||||
"expected_values": [
|
||||
"true",
|
||||
"false",
|
||||
"1",
|
||||
"0"
|
||||
]
|
||||
},
|
||||
"fieldName": "omu_supported",
|
||||
"displayName": "omu_supported",
|
||||
"type": "boolean",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The JVM's current daemon count."
|
||||
},
|
||||
"fieldName": "daemon_thread_count",
|
||||
"displayName": "daemon_thread_count",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "User-space time taken by the JVM, in seconds."
|
||||
},
|
||||
"fieldName": "current_user_time",
|
||||
"displayName": "current_user_time",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Indicates whether the Java virtual machine supports CPU time measurement for the current thread.",
|
||||
"expected_values": [
|
||||
"true",
|
||||
"false",
|
||||
"1",
|
||||
"0"
|
||||
]
|
||||
},
|
||||
"fieldName": "cpu_time_supported",
|
||||
"displayName": "cpu_time_supported",
|
||||
"type": "boolean",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "CPU-space time taken by the JVM, in seconds."
|
||||
},
|
||||
"fieldName": "current_cpu_time",
|
||||
"displayName": "current_cpu_time",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"jvm",
|
||||
"runtime"
|
||||
]
|
||||
},
|
||||
"objectName": "Runtime",
|
||||
"displayName": "Runtime",
|
||||
"parentName": "JVM",
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=runtime"
|
||||
}
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Version of the JVM."
|
||||
},
|
||||
"fieldName": "version",
|
||||
"displayName": "version",
|
||||
"type": "string",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Uptime of the JVM process, in seconds."
|
||||
},
|
||||
"fieldName": "uptime",
|
||||
"displayName": "uptime",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Start time of the JVM process."
|
||||
},
|
||||
"fieldName": "start_time",
|
||||
"displayName": "start_time",
|
||||
"type": "timestamp",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Process name of the JVM process."
|
||||
},
|
||||
"fieldName": "process_name",
|
||||
"displayName": "process_name",
|
||||
"type": "string",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Runtime_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The JVM product or service. This field can be automatically populated by the the vendor and product fields in your raw data."
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"jvm",
|
||||
"os"
|
||||
]
|
||||
},
|
||||
"objectName": "OS",
|
||||
"displayName": "OS",
|
||||
"parentName": "JVM",
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=os"
|
||||
}
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "OS version that the JVM is running on."
|
||||
},
|
||||
"fieldName": "os_version",
|
||||
"displayName": "os_version",
|
||||
"type": "string",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Swap memory space available to the OS that the JVM is running on, in bytes."
|
||||
},
|
||||
"fieldName": "swap_space",
|
||||
"displayName": "swap_space",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Physical memory available to the OS that the JVM is running on, in bytes."
|
||||
},
|
||||
"fieldName": "physical_memory",
|
||||
"displayName": "physical_memory",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "System load of the OS that the JVM is running on."
|
||||
},
|
||||
"fieldName": "system_load",
|
||||
"displayName": "system_load",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Amount of CPU time taken by the JVM, in seconds."
|
||||
},
|
||||
"fieldName": "cpu_time",
|
||||
"displayName": "cpu_time",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "OS that the JVM is running on."
|
||||
},
|
||||
"fieldName": "os",
|
||||
"displayName": "os",
|
||||
"type": "string",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Number of file descriptors opened by the JVM."
|
||||
},
|
||||
"fieldName": "open_file_descriptors",
|
||||
"displayName": "open_file_descriptors",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Maximum file descriptors available to the JVM."
|
||||
},
|
||||
"fieldName": "max_file_descriptors",
|
||||
"displayName": "max_file_descriptors",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Amount of free swap memory remaining to the JVM, in bytes."
|
||||
},
|
||||
"fieldName": "free_swap",
|
||||
"displayName": "free_swap",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Amount of free physical memory remaining to the JVM, in bytes."
|
||||
},
|
||||
"fieldName": "free_physical_memory",
|
||||
"displayName": "free_physical_memory",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Amount of memory committed to the JVM, in bytes."
|
||||
},
|
||||
"fieldName": "committed_memory",
|
||||
"displayName": "committed_memory",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Total processor cores available to the OS that the JVM is running on."
|
||||
},
|
||||
"fieldName": "total_processors",
|
||||
"displayName": "total_processors",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "OS architecture that the JVM is running on."
|
||||
},
|
||||
"fieldName": "os_architecture",
|
||||
"displayName": "os_architecture",
|
||||
"type": "string",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"jvm",
|
||||
"compilation"
|
||||
]
|
||||
},
|
||||
"objectName": "Compilation",
|
||||
"displayName": "Compilation",
|
||||
"parentName": "JVM",
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=compilation"
|
||||
}
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Time taken by JIT compilation, in seconds."
|
||||
},
|
||||
"fieldName": "compilation_time",
|
||||
"displayName": "compilation_time",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"jvm",
|
||||
"classloading"
|
||||
]
|
||||
},
|
||||
"objectName": "Classloading",
|
||||
"displayName": "Classloading",
|
||||
"parentName": "JVM",
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=classloading"
|
||||
}
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The total count of classes loaded in the JVM."
|
||||
},
|
||||
"fieldName": "total_loaded",
|
||||
"displayName": "total_loaded",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The current count of classes loaded in the JVM."
|
||||
},
|
||||
"fieldName": "current_loaded",
|
||||
"displayName": "current_loaded",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The total count of classes unloaded from the JVM."
|
||||
},
|
||||
"fieldName": "total_unloaded",
|
||||
"displayName": "total_unloaded",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"jvm",
|
||||
"memory"
|
||||
]
|
||||
},
|
||||
"objectName": "Memory",
|
||||
"displayName": "Memory",
|
||||
"parentName": "JVM",
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=memory"
|
||||
}
|
||||
],
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Non-heap memory used by the JVM, in bytes."
|
||||
},
|
||||
"fieldName": "non_heap_used",
|
||||
"displayName": "non_heap_used",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Maximum amount of non-heap memory used by the JVM, in bytes."
|
||||
},
|
||||
"fieldName": "non_heap_max",
|
||||
"displayName": "non_heap_max",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Initial amount of non-heap memory used by the JVM, in bytes."
|
||||
},
|
||||
"fieldName": "non_heap_initial",
|
||||
"displayName": "non_heap_initial",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Committed amount of non-heap memory used by the JVM, in bytes."
|
||||
},
|
||||
"fieldName": "non_heap_committed",
|
||||
"displayName": "non_heap_committed",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Heap memory used by the JVM, in bytes."
|
||||
},
|
||||
"fieldName": "heap_used",
|
||||
"displayName": "heap_used",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Maximum amount of heap memory used by the JVM, in bytes."
|
||||
},
|
||||
"fieldName": "heap_max",
|
||||
"displayName": "heap_max",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Initial amount of heap memory used by the JVM, in bytes."
|
||||
},
|
||||
"fieldName": "heap_initial",
|
||||
"displayName": "heap_initial",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Committed amount of heap memory used by the JVM, in bytes."
|
||||
},
|
||||
"fieldName": "heap_committed",
|
||||
"displayName": "heap_committed",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Number of objects pending in the JVM."
|
||||
},
|
||||
"fieldName": "objects_pending",
|
||||
"displayName": "objects_pending",
|
||||
"type": "number",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false,
|
||||
"constraints": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,723 @@
|
||||
{
|
||||
"modelName": "Malware",
|
||||
"displayName": "Malware",
|
||||
"description": "Malware Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"malware",
|
||||
"attack"
|
||||
]
|
||||
},
|
||||
"objectName": "Malware_Attacks",
|
||||
"displayName": "Malware Attacks",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_requires_av",
|
||||
"displayName": "dest_requires_av",
|
||||
"type": "boolean",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The hash of the file with suspected malware."
|
||||
},
|
||||
"fieldName": "file_hash",
|
||||
"displayName": "file_hash",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the file with suspected malware."
|
||||
},
|
||||
"fieldName": "file_name",
|
||||
"displayName": "file_name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The full file path of the file with suspected malware."
|
||||
},
|
||||
"fieldName": "file_path",
|
||||
"displayName": "file_path",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The numeric or vendor specific severity indicator corresponding to the event severity."
|
||||
},
|
||||
"fieldName": "severity_id",
|
||||
"displayName": "severity_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique identifier or event code of the event signature."
|
||||
},
|
||||
"fieldName": "signature_id",
|
||||
"displayName": "signature_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The source of the endpoint event, such as a DAT file relay server. You can alias this from more specific fields, such as src_host, src_ip, or src_name."
|
||||
},
|
||||
"fieldName": "src",
|
||||
"displayName": "src",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the source.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_bunit",
|
||||
"displayName": "src_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the source.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_category",
|
||||
"displayName": "src_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the source.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_priority",
|
||||
"displayName": "src_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The reported sender of an email-based attack."
|
||||
},
|
||||
"fieldName": "src_user",
|
||||
"displayName": "src_user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "A URL containing more information about the vulnerability."
|
||||
},
|
||||
"fieldName": "url",
|
||||
"displayName": "url",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_bunit",
|
||||
"displayName": "user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_category",
|
||||
"displayName": "user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_priority",
|
||||
"displayName": "user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Malware_Attacks_fillnull_action",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The action taken by the reporting device.",
|
||||
"expected_values": [
|
||||
"allowed",
|
||||
"blocked",
|
||||
"deferred"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "action",
|
||||
"displayName": "action",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(action) OR action=\"\",\"unknown\",action)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Malware_Attacks_fillnull_category",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the malware event, such as keylogger or ad-supported program. Note: This is a string value. Use category_id for category ID fields that are integer data types. The category_id field is optional, so it is not included in the data model.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "category",
|
||||
"displayName": "category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(category) OR category=\"\",\"unknown\",category)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Malware_Attacks_date",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The date of the malware event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "date",
|
||||
"displayName": "date",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "strftime(_time, \"%m-%d-%Y\")"
|
||||
},
|
||||
{
|
||||
"calculationID": "Malware_Attacks_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The system that was affected by the malware event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Malware_Attacks_fillnull_dest_nt_domain",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The NT domain of the destination, if applicable.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest_nt_domain",
|
||||
"displayName": "dest_nt_domain",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest_nt_domain) OR dest_nt_domain=\"\",\"unknown\",dest_nt_domain)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Malware_Attacks_fillnull_severity",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The severity of the network protection event. Note: This field is a string. Use severity_id for severity ID fields that are integer data types. The severity_id field is optional, so it is not included in the model. Also, specific values are required for this field. Use vendor_severity for the vendor's own human readable severity strings, such as Good, Bad, and Really Bad.",
|
||||
"expected_values": [
|
||||
"critical",
|
||||
"high",
|
||||
"medium",
|
||||
"low",
|
||||
"informational"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "severity",
|
||||
"displayName": "severity",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Malware_Attacks_fillnull_signature",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the malware infection detected on the client (the dest), such as Trojan.Vundo, Spyware.Gaobot, and W32.Nimbda. Note: This is a string value. Use signature_id for signature ID fields that are integer data types. The signature_id field is optional, so it is not included in the data model.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "signature",
|
||||
"displayName": "signature",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Malware_Attacks_fillnull_user",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user involved in the malware event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(user) OR user=\"\",\"unknown\",user)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Malware_Attacks_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor and product name of the endpoint protection system, such as Symantec AntiVirus. This field can be automatically populated by vendor and product fields in your data.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Malware_indexes`) tag=malware tag=attack"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"malware",
|
||||
"attack"
|
||||
]
|
||||
},
|
||||
"objectName": "Allowed_Malware",
|
||||
"displayName": "Allowed Malware",
|
||||
"parentName": "Malware_Attacks",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "action=\"allowed\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"malware",
|
||||
"attack"
|
||||
]
|
||||
},
|
||||
"objectName": "Blocked_Malware",
|
||||
"displayName": "Blocked Malware",
|
||||
"parentName": "Malware_Attacks",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "action=\"blocked\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"malware",
|
||||
"attack"
|
||||
]
|
||||
},
|
||||
"objectName": "Deferred_Malware",
|
||||
"displayName": "Quarantined Malware",
|
||||
"parentName": "Malware_Attacks",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "action=\"deferred\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"malware",
|
||||
"operations"
|
||||
]
|
||||
},
|
||||
"objectName": "Malware_Operations",
|
||||
"displayName": "Malware Operations",
|
||||
"parentName": "BaseSearch",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The event timestamp expressed in Unix time.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "_time",
|
||||
"displayName": "_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_requires_av",
|
||||
"displayName": "dest_requires_av",
|
||||
"type": "boolean",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The product version of the malware operations product.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "product_version",
|
||||
"displayName": "product_version",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The version of the malware signature bundle in a signature update operations event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "signature_version",
|
||||
"displayName": "signature_version",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Malware_Operations_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The system where the malware operations event occurred.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Malware_Operations_fillnull_dest_nt_domain",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The NT domain of the dest system, if applicable.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest_nt_domain",
|
||||
"displayName": "dest_nt_domain",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest_nt_domain) OR dest_nt_domain=\"\",\"unknown\",dest_nt_domain)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Malware_Operations_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor product name of the malware operations product.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
|
||||
],
|
||||
"baseSearch": "(`cim_Malware_indexes`) tag=malware tag=operations | tags outputfield=tag",
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,506 @@
|
||||
{
|
||||
"modelName": "Network_Resolution",
|
||||
"displayName": "Network Resolution (DNS)",
|
||||
"description": "Network Resolution Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"network",
|
||||
"resolution",
|
||||
"dns"
|
||||
]
|
||||
},
|
||||
"objectName": "DNS",
|
||||
"displayName": "DNS",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Number of entries in the 'additional' section of the DNS message."
|
||||
},
|
||||
"fieldName": "additional_answer_count",
|
||||
"displayName": "additional_answer_count",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Number of entries in the 'authority' section of the DNS message."
|
||||
},
|
||||
"fieldName": "authority_answer_count",
|
||||
"displayName": "authority_answer_count",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the destination.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the network resolution target, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The destination port number."
|
||||
},
|
||||
"fieldName": "dest_port",
|
||||
"displayName": "dest_port",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the destination, if applicable.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The time taken by the network resolution event, in seconds."
|
||||
},
|
||||
"fieldName": "duration",
|
||||
"displayName": "duration",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the DNS event."
|
||||
},
|
||||
"fieldName": "name",
|
||||
"displayName": "name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Number of entries that appear in the 'Questions' section of the DNS query.",
|
||||
"expected_values": [
|
||||
"Query",
|
||||
"IQuery",
|
||||
"Status",
|
||||
"Notify",
|
||||
"Update",
|
||||
"A",
|
||||
"MX",
|
||||
"NS",
|
||||
"PTR"
|
||||
]
|
||||
},
|
||||
"fieldName": "query_type",
|
||||
"displayName": "query_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The DNS resource record type. For details, see the List of DNS record types on Wikipedia.",
|
||||
"expected_values": [
|
||||
"A",
|
||||
"DNAME",
|
||||
"MX",
|
||||
"NS",
|
||||
"PTR"
|
||||
]
|
||||
},
|
||||
"fieldName": "record_type",
|
||||
"displayName": "record_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of time it took to receive a response in the network resolution event, in seconds."
|
||||
},
|
||||
"fieldName": "response_time",
|
||||
"displayName": "response_time",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The source of the network resolution event. You can alias this from more specific fields, such as src_host, src_ip, or src_name."
|
||||
},
|
||||
"fieldName": "src",
|
||||
"displayName": "src",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_bunit",
|
||||
"displayName": "src_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the source, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_category",
|
||||
"displayName": "src_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The port number of the source."
|
||||
},
|
||||
"fieldName": "src_port",
|
||||
"displayName": "src_port",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the source.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_priority",
|
||||
"displayName": "src_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The transport protocol used by the network resolution event."
|
||||
},
|
||||
"fieldName": "transport",
|
||||
"displayName": "transport",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique numerical transaction id of the network resolution event."
|
||||
},
|
||||
"fieldName": "transaction_id",
|
||||
"displayName": "transaction_id",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The time-to-live of the network resolution event, in seconds."
|
||||
},
|
||||
"fieldName": "ttl",
|
||||
"displayName": "ttl",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "DNS_0fillnull_answer",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Resolved address for the query.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "answer",
|
||||
"displayName": "answer",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(answer) OR answer=\"\",\"unknown\",answer)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DNS_answer_count",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Number of entries in the answer section of the DNS message.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "answer_count",
|
||||
"displayName": "answer_count",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnum(answer_count),answer_count,isnotnull(answer),mvcount(answer),1=1,1)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DNS_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The destination of the network resolution event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DNS_fillnull_message_type",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Type of DNS message.",
|
||||
"expected_values": [
|
||||
"Query",
|
||||
"Response"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "message_type",
|
||||
"displayName": "message_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(message_type) OR message_type=\"\",\"unknown\",message_type)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DNS_0fillnull_query",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The domain which needs to be resolved. Applies to messages of type 'Query'.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "query",
|
||||
"displayName": "query",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(query) OR query=\"\",\"unknown\",query)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DNS_query_count",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Number of entries that appear in the 'Questions' section of the DNS query.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "query_count",
|
||||
"displayName": "query_count",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnum(query_count),query_count,isnotnull(query),mvcount(query),1=1,1)"
|
||||
},
|
||||
{
|
||||
"calculationID": "DNS_0fillnull_reply_code_id",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The numerical id or name of a return code. For details, see the Domain Name System Parameters on the Internet Assigned Numbers Authority (IANA) web site.",
|
||||
"expected_values": [
|
||||
"0",
|
||||
"NoError",
|
||||
"1",
|
||||
"FormErr",
|
||||
"2",
|
||||
"ServFail",
|
||||
"3",
|
||||
"NXDomain",
|
||||
"etc."
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "reply_code_id",
|
||||
"displayName": "reply_code_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(reply_code_id) AND reply_code_id!=\"\",reply_code_id,isnotnull(reply_code) AND reply_code!=\"\",reply_code,1=1,\"unknown\")"
|
||||
},
|
||||
{
|
||||
"calculationID": "DNS_reply_code",
|
||||
"calculationType": "Lookup",
|
||||
"lookupName": "cim_dns_reply_code_lookup",
|
||||
"lookupInputs": [
|
||||
{
|
||||
"inputField": "reply_code_id",
|
||||
"lookupField": "reply_code_id"
|
||||
}
|
||||
],
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The return code for the response. For details, see the Domain Name System Parameters on the Internet Assigned Numbers Authority (IANA) web site.",
|
||||
"expected_values": [
|
||||
"No Error",
|
||||
"Format Error",
|
||||
"Server Failure",
|
||||
"Non-Existent Domain",
|
||||
"etc."
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"lookupOutputFieldName": "reply_code",
|
||||
"fieldName": "reply_code",
|
||||
"displayName": "reply_code",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"calculationID": "DNS_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor product name of the DNS server. The Splunk platform can derive this field from the fields vendor and product in the raw data, if they exist.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Network_Resolution_indexes`) tag=network tag=resolution tag=dns"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,516 @@
|
||||
{
|
||||
"modelName": "Network_Sessions",
|
||||
"displayName": "Network Sessions",
|
||||
"description": "Network Sessions Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"network",
|
||||
"session"
|
||||
]
|
||||
},
|
||||
"objectName": "All_Sessions",
|
||||
"displayName": "All Sessions",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The action taken by the reporting device."
|
||||
},
|
||||
"fieldName": "action",
|
||||
"displayName": "action",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the destination.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the destination.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the destination.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of time for the completion of the network session event, in seconds."
|
||||
},
|
||||
"fieldName": "duration",
|
||||
"displayName": "duration",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of time it took to receive a response in the network session event, in seconds."
|
||||
},
|
||||
"fieldName": "response_time",
|
||||
"displayName": "response_time",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "An indication of the type of network session event."
|
||||
},
|
||||
"fieldName": "signature",
|
||||
"displayName": "signature",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique identifier or event code of the event signature."
|
||||
},
|
||||
"fieldName": "signature_id",
|
||||
"displayName": "signature_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the source.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_bunit",
|
||||
"displayName": "src_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the source.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_category",
|
||||
"displayName": "src_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The external domain name of the client initializing a network session. Not applicable for DHCP events."
|
||||
},
|
||||
"fieldName": "src_dns",
|
||||
"displayName": "src_dns",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The IP address of the client initializing a network session. Not applicable for DHCP events."
|
||||
},
|
||||
"fieldName": "src_ip",
|
||||
"displayName": "src_ip",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The MAC address of the client initializing a network session. Not applicable for DHCP events."
|
||||
},
|
||||
"fieldName": "src_mac",
|
||||
"displayName": "src_mac",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The NetBIOS name of the client initializing a network session. Not applicable for DHCP events."
|
||||
},
|
||||
"fieldName": "src_nt_host",
|
||||
"displayName": "src_nt_host",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the source.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_priority",
|
||||
"displayName": "src_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit associated with the user.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_bunit",
|
||||
"displayName": "user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the user.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_category",
|
||||
"displayName": "user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the user.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_priority",
|
||||
"displayName": "user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "All_Sessions_fillnull_dest_ip",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The internal IP address allocated to the client initializing a network session. For DHCP and VPN events, this is the IP address leased to the client.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest_ip",
|
||||
"displayName": "dest_ip",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(source LIKE \"stream%\" AND isnotnull(yiaddr) AND yiaddr!=\"\",yiaddr,isnull(dest_ip) OR dest_ip=\"\",\"unknown\",1=1,dest_ip)"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Sessions_fillnull_dest_mac",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The internal MAC address of the network session client. For DHCP events, this is the MAC address of the client acquiring an IP address lease. For VPN events, this is the MAC address of the client initializing a network session.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest_mac",
|
||||
"displayName": "dest_mac",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(source LIKE \"stream%\" AND isnotnull(chaddr) AND chaddr!=\"\",chaddr,isnull(dest_mac) OR dest_mac=\"\",\"unknown\",1=1,dest_mac)"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Sessions_fillnull_dest_nt_host",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The NetBIOS name of the client initializing a network session.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest_nt_host",
|
||||
"displayName": "dest_nt_host",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest_nt_host) OR dest_nt_host=\"\",\"unknown\",dest_nt_host)"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Sessions_fillnull_dest_dns",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The domain name system address of the destination for a network session event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest_dns",
|
||||
"displayName": "dest_dns",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest_dns) OR dest_dns=\"\",\"unknown\",dest_dns)"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Sessions_fillnull_user",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user in a network session event, where applicable. For example, a VPN session or an authenticated DHCP event.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(user) OR user=\"\",\"unknown\",user)"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Sessions_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The full name of the Dynamic Host Configuration Protocol (DHCP) or DNS server involved in this event including vendor and product name, such as Microsoft DHCP or ISC BIND. This field is generated by combining the values of the vendor and product fields.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Network_Sessions_indexes`) tag=network tag=session"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"network",
|
||||
"session",
|
||||
"start"
|
||||
]
|
||||
},
|
||||
"objectName": "Session_Start",
|
||||
"displayName": "Session Start",
|
||||
"parentName": "All_Sessions",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=start"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"network",
|
||||
"session",
|
||||
"end"
|
||||
]
|
||||
},
|
||||
"objectName": "Session_End",
|
||||
"displayName": "Session End",
|
||||
"parentName": "All_Sessions",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=end"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"network",
|
||||
"session",
|
||||
"dhcp"
|
||||
]
|
||||
},
|
||||
"objectName": "DHCP",
|
||||
"displayName": "DHCP",
|
||||
"parentName": "All_Sessions",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The duration of the Dynamic Host Configuration Protocol (DHCP) lease, in seconds."
|
||||
},
|
||||
"fieldName": "lease_duration",
|
||||
"displayName": "lease_duration",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The consecutive range of possible IP addresses that the Dynamic Host Configuration Protocol (DHCP) server can lease to clients on a subnet. A lease_scope typically defines a single physical subnet on your network to which DHCP services are offered."
|
||||
},
|
||||
"fieldName": "lease_scope",
|
||||
"displayName": "lease_scope",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=dhcp"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"network",
|
||||
"session",
|
||||
"vpn"
|
||||
]
|
||||
},
|
||||
"objectName": "VPN",
|
||||
"displayName": "VPN",
|
||||
"parentName": "All_Sessions",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=vpn"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,844 @@
|
||||
{
|
||||
"modelName": "Performance",
|
||||
"displayName": "Performance",
|
||||
"description": "Performance Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"ta_relevant": false
|
||||
},
|
||||
"objectName": "All_Performance",
|
||||
"displayName": "All Performance",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the system where the event occurred. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the system where the event occurred. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the system where the performance event occurred.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Indicates whether or not the system where the performance event occurred should time sync. This field is automatically provided by Asset and Identity correlation features of applications like the Splunk App for Enterprise Security.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_should_timesync",
|
||||
"displayName": "dest_should_timesync",
|
||||
"type": "boolean",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Indicates whether or not the system where the performance event occurred should update. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_should_update",
|
||||
"displayName": "dest_should_update",
|
||||
"type": "boolean",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The ID of the virtualization hypervisor."
|
||||
},
|
||||
"fieldName": "hypervisor_id",
|
||||
"displayName": "hypervisor_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The type of facilities resource involved in the performance event, such as a rack, room, or system."
|
||||
},
|
||||
"fieldName": "resource_type",
|
||||
"displayName": "resource_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "All_Performance_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The system where the event occurred, usually a facilities resource such as a rack or room. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Performance_indexes`) tag=performance (tag=cpu OR tag=facilities OR tag=memory OR tag=storage OR tag=network OR (tag=os ((tag=time tag=synchronize) OR tag=uptime)))"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"performance",
|
||||
"cpu"
|
||||
]
|
||||
},
|
||||
"objectName": "CPU",
|
||||
"displayName": "CPU",
|
||||
"parentName": "All_Performance",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of CPU load reported by the controller in megahertz."
|
||||
},
|
||||
"fieldName": "cpu_load_mhz",
|
||||
"displayName": "cpu_load_mhz",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of CPU load reported by the controller in percentage points.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "cpu_load_percent",
|
||||
"displayName": "cpu_load_percent",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The number of CPU seconds consumed by processes."
|
||||
},
|
||||
"fieldName": "cpu_time",
|
||||
"displayName": "cpu_time",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Percentage of CPU user time consumed by processes."
|
||||
},
|
||||
"fieldName": "cpu_user_percent",
|
||||
"displayName": "cpu_user_percent",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=cpu"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"performance",
|
||||
"facilities"
|
||||
]
|
||||
},
|
||||
"objectName": "Facilities",
|
||||
"displayName": "Facilities",
|
||||
"parentName": "All_Performance",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Average temperature of the facilities resource, in degrees Celsius.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "temperature",
|
||||
"displayName": "temperature",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Amount of power consumed by the facilities resource, in Kw\/h."
|
||||
},
|
||||
"fieldName": "power",
|
||||
"displayName": "power",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The speed of the cooling fan in the facilities resource, in rotations per second."
|
||||
},
|
||||
"fieldName": "fan_speed",
|
||||
"displayName": "fan_speed",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=facilities"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"performance",
|
||||
"memory"
|
||||
]
|
||||
},
|
||||
"objectName": "Memory",
|
||||
"displayName": "Memory",
|
||||
"parentName": "All_Performance",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The total amount of memory capacity reported by the resource, in megabytes.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "mem",
|
||||
"displayName": "mem",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The committed amount of memory reported by the resource, in megabytes."
|
||||
},
|
||||
"fieldName": "mem_committed",
|
||||
"displayName": "mem_committed",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The free amount of memory reported by the resource, in megabytes.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "mem_free",
|
||||
"displayName": "mem_free",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The used amount of memory reported by the resource, in megabytes.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "mem_used",
|
||||
"displayName": "mem_used",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The total swap space size, in megabytes, if applicable."
|
||||
},
|
||||
"fieldName": "swap",
|
||||
"displayName": "swap",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The free swap space size, in megabytes, if applicable."
|
||||
},
|
||||
"fieldName": "swap_free",
|
||||
"displayName": "swap_free",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The used swap space size, in megabytes, if applicable."
|
||||
},
|
||||
"fieldName": "swap_used",
|
||||
"displayName": "swap_used",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=memory"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"performance",
|
||||
"storage"
|
||||
]
|
||||
},
|
||||
"objectName": "Storage",
|
||||
"displayName": "Storage",
|
||||
"parentName": "All_Performance",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The array that the resource is a member of, if applicable."
|
||||
},
|
||||
"fieldName": "array",
|
||||
"displayName": "array",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Block size used by the storage resource, in kilobytes."
|
||||
},
|
||||
"fieldName": "blocksize",
|
||||
"displayName": "blocksize",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The cluster that the resource is a member of, if applicable."
|
||||
},
|
||||
"fieldName": "cluster",
|
||||
"displayName": "cluster",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The maximum number of available file descriptors."
|
||||
},
|
||||
"fieldName": "fd_max",
|
||||
"displayName": "fd_max",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The current number of open file descriptors."
|
||||
},
|
||||
"fieldName": "fd_used",
|
||||
"displayName": "fd_used",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The latency reported by the resource, in milliseconds."
|
||||
},
|
||||
"fieldName": "latency",
|
||||
"displayName": "latency",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The mount point of a storage resource."
|
||||
},
|
||||
"fieldName": "mount",
|
||||
"displayName": "mount",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "A generic indicator of hierarchy. For instance, a disk event might include the array id here."
|
||||
},
|
||||
"fieldName": "parent",
|
||||
"displayName": "parent",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Number of blocks read."
|
||||
},
|
||||
"fieldName": "read_blocks",
|
||||
"displayName": "read_blocks",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The latency of read operations, in milliseconds."
|
||||
},
|
||||
"fieldName": "read_latency",
|
||||
"displayName": "read_latency",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Number of read operations."
|
||||
},
|
||||
"fieldName": "read_ops",
|
||||
"displayName": "read_ops",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The total amount of storage capacity reported by the resource, in megabytes."
|
||||
},
|
||||
"fieldName": "storage",
|
||||
"displayName": "storage",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The free amount of storage capacity reported by the resource, in megabytes.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "storage_free",
|
||||
"displayName": "storage_free",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The percentage of storage capacity reported by the resource that is free.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "storage_free_percent",
|
||||
"displayName": "storage_free_percent",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The used amount of storage capacity reported by the resource, in megabytes.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "storage_used",
|
||||
"displayName": "storage_used",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The percentage of storage capacity reported by the resource that is used.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "storage_used_percent",
|
||||
"displayName": "storage_used_percent",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The number of blocks written by the resource."
|
||||
},
|
||||
"fieldName": "write_blocks",
|
||||
"displayName": "write_blocks",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The latency of write operations, in milliseconds."
|
||||
},
|
||||
"fieldName": "write_latency",
|
||||
"displayName": "write_latency",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The total number of write operations processed by the resource."
|
||||
},
|
||||
"fieldName": "write_ops",
|
||||
"displayName": "write_ops",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=storage"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"performance",
|
||||
"network"
|
||||
]
|
||||
},
|
||||
"objectName": "Network",
|
||||
"displayName": "Network",
|
||||
"parentName": "All_Performance",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The current throughput reported by the service, in bytes.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "thruput",
|
||||
"displayName": "thruput",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The maximum possible throughput reported by the service, in bytes."
|
||||
},
|
||||
"fieldName": "thruput_max",
|
||||
"displayName": "thruput_max",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=network"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"performance",
|
||||
"os"
|
||||
]
|
||||
},
|
||||
"objectName": "OS",
|
||||
"displayName": "OS",
|
||||
"parentName": "All_Performance",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The event description signature, if available.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "signature",
|
||||
"displayName": "signature",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique identifier or event code of the event signature."
|
||||
},
|
||||
"fieldName": "signature_id",
|
||||
"displayName": "signature_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=os"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"performance",
|
||||
"os",
|
||||
"time",
|
||||
"synchronize"
|
||||
]
|
||||
},
|
||||
"objectName": "Timesync",
|
||||
"displayName": "Time Synchronization",
|
||||
"parentName": "OS",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Timesync_fillnull_action",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The result of a time sync event.",
|
||||
"expected_values": [
|
||||
"success",
|
||||
"failure"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "action",
|
||||
"displayName": "action",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(action) AND action!=\"\",action,tag=\"success\",\"success\",tag=\"failure\",\"failure\",1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=time tag=synchronize"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"performance",
|
||||
"os",
|
||||
"uptime"
|
||||
]
|
||||
},
|
||||
"objectName": "Uptime",
|
||||
"displayName": "System Uptime",
|
||||
"parentName": "OS",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Uptime_fillnull_uptime",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The uptime of the compute resource, in seconds.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "uptime",
|
||||
"displayName": "uptime",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(uptime) OR uptime=\"\",\"unknown\",uptime)"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=uptime"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,563 @@
|
||||
{
|
||||
"modelName": "Risk",
|
||||
"displayName": "Risk Analysis",
|
||||
"description": "Risk Analysis Data Model",
|
||||
"editable": false,
|
||||
"comment": {
|
||||
"ta_relevant": false
|
||||
},
|
||||
"objects": [
|
||||
{
|
||||
"objectName": "All_Risk",
|
||||
"displayName": "All Risk Modifiers",
|
||||
"parentName": "BaseSearch",
|
||||
"fields": [
|
||||
{
|
||||
"fieldName": "analyticstories",
|
||||
"displayName": "analyticstories",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations",
|
||||
"displayName": "annotations",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations._all",
|
||||
"displayName": "annotations._all",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations._frameworks",
|
||||
"displayName": "annotations._frameworks",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations.cis20",
|
||||
"displayName": "annotations.cis20",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations.kill_chain_phases",
|
||||
"displayName": "annotations.kill_chain_phases",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations.mitre_attack",
|
||||
"displayName": "annotations.mitre_attack",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations.mitre_attack.mitre_description",
|
||||
"displayName": "annotations.mitre_attack.mitre_description",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations.mitre_attack.mitre_detection",
|
||||
"displayName": "annotations.mitre_attack.mitre_detection",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations.mitre_attack.mitre_tactic",
|
||||
"displayName": "annotations.mitre_attack.mitre_tactic",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations.mitre_attack.mitre_tactic_id",
|
||||
"displayName": "annotations.mitre_attack.mitre_tactic_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations.mitre_attack.mitre_technique",
|
||||
"displayName": "annotations.mitre_attack.mitre_technique",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations.mitre_attack.mitre_technique_id",
|
||||
"displayName": "annotations.mitre_attack.mitre_technique_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations.mitre_attack.mitre_threat_group_name",
|
||||
"displayName": "annotations.mitre_attack.mitre_threat_group_name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "annotations.nist",
|
||||
"displayName": "annotations.nist",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "control",
|
||||
"displayName": "control",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "creator",
|
||||
"displayName": "creator",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons."
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons."
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons."
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "governance",
|
||||
"displayName": "governance",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the risk_object involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons."
|
||||
},
|
||||
"fieldName": "risk_object_bunit",
|
||||
"displayName": "risk_object_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the risk_object involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons."
|
||||
},
|
||||
"fieldName": "risk_object_category",
|
||||
"displayName": "risk_object_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the risk_object involved in the event, or who initiated the event. For authentication privilege escalation events, this should represent the user priority targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons."
|
||||
},
|
||||
"fieldName": "risk_object_priority",
|
||||
"displayName": "risk_object_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "savedsearch_description",
|
||||
"displayName": "savedsearch_description",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "src",
|
||||
"displayName": "src",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons."
|
||||
},
|
||||
"fieldName": "src_bunit",
|
||||
"displayName": "src_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons."
|
||||
},
|
||||
"fieldName": "src_category",
|
||||
"displayName": "src_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons."
|
||||
},
|
||||
"fieldName": "src_priority",
|
||||
"displayName": "src_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "threat_object",
|
||||
"displayName": "threat_object",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons."
|
||||
},
|
||||
"fieldName": "user_bunit",
|
||||
"displayName": "user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons."
|
||||
},
|
||||
"fieldName": "user_category",
|
||||
"displayName": "user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons."
|
||||
},
|
||||
"fieldName": "user_priority",
|
||||
"displayName": "user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "All_Risk_1description",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "description",
|
||||
"displayName": "description",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(description),description,isnotnull(savedsearch_description),savedsearch_description,1=1,\"unknown\")"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Risk_risk_object",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "risk_object",
|
||||
"displayName": "risk_object",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(risk_object),\"unknown\",risk_object)"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Risk_risk_object_type",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "risk_object_type",
|
||||
"displayName": "risk_object_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(risk_object_type),\"unknown\",risk_object_type)"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Risk_risk_score",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "risk_score",
|
||||
"displayName": "risk_score",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(risk_score),0,risk_score)"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Risk_threat_object_type",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "threat_object_type",
|
||||
"displayName": "threat_object_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnotnull(threat_object) AND isnull(threat_object_type),\"unknown\",threat_object_type)"
|
||||
},
|
||||
{
|
||||
"calculationID": "0_All_Risk_risk_factor_add",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "risk_factor_add",
|
||||
"displayName": "risk_factor_add",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "0"
|
||||
},
|
||||
{
|
||||
"calculationID": "1_All_Risk_risk_factor_add_matched",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "risk_factor_add_matched",
|
||||
"displayName": "risk_factor_add_matched",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "null"
|
||||
},
|
||||
{
|
||||
"calculationID": "2_All_Risk_risk_factor_mult",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "risk_factor_mult",
|
||||
"displayName": "risk_factor_mult",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "1"
|
||||
},
|
||||
{
|
||||
"calculationID": "3_All_Risk_risk_factor_mult_matched",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "risk_factor_mult_matched",
|
||||
"displayName": "risk_factor_mult_matched",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "null"
|
||||
},
|
||||
{
|
||||
"calculationID": "4_All_Risk_calculated_risk_score",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "calculated_risk_score",
|
||||
"displayName": "calculated_risk_score",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "(risk_score + risk_factor_add) * risk_factor_mult"
|
||||
},
|
||||
{
|
||||
"calculationID": "5_All_Risk_risk_message",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "risk_message",
|
||||
"displayName": "risk_message",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(risk_message),risk_message,isnotnull(description),description,isnotnull(savedsearch_description),savedsearch_description,1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
|
||||
],
|
||||
"baseSearch": "index=risk | eval tag=mvdedup(mvappend(tag,NULL,orig_tag)), governance_lookup_type=\"default\" | lookup governance_lookup savedsearch as source, lookup_type as governance_lookup_type OUTPUT governance, control | eval governance_lookup_type=\"tag\" | lookup governance_lookup savedsearch as source, tag, lookup_type as governance_lookup_type OUTPUT governance as governance_tag, control as control_tag | eval \"governance\"=mvappend('governance',NULL,'governance_tag'),\"control\"=mvappend('control',NULL,'control_tag') | fields - governance_lookup_type,governance_tag,control_tag",
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,462 @@
|
||||
{
|
||||
"modelName": "Ticket_Management",
|
||||
"displayName": "Ticket Management",
|
||||
"description": "Ticket Management Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"ticketing"
|
||||
]
|
||||
},
|
||||
"objectName": "All_Ticket_Management",
|
||||
"displayName": "All Ticket Management",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Destinations affected by the service request."
|
||||
},
|
||||
"fieldName": "affect_dest",
|
||||
"displayName": "affect_dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Comments about the service request."
|
||||
},
|
||||
"fieldName": "comments",
|
||||
"displayName": "comments",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The description of the service request."
|
||||
},
|
||||
"fieldName": "description",
|
||||
"displayName": "description",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit of the destination.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the destination.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the destination.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The relative priority of the service request."
|
||||
},
|
||||
"fieldName": "priority",
|
||||
"displayName": "priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The relative severity of the service request."
|
||||
},
|
||||
"fieldName": "severity",
|
||||
"displayName": "severity",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The numeric or vendor specific severity indicator corresponding to the event severity."
|
||||
},
|
||||
"fieldName": "severity_id",
|
||||
"displayName": "severity_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique identifier of the service request as it pertains to Splunk. For example, 14DA67E8-6084-4FA8-9568-48D05969C522@@_internal@@0533eff241db0d892509be46cd3126e30e0f6046."
|
||||
},
|
||||
"fieldName": "splunk_id",
|
||||
"displayName": "splunk_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The Splunk application or use case associated with the unique identifier (splunk_id). For example, es_notable."
|
||||
},
|
||||
"fieldName": "splunk_realm",
|
||||
"displayName": "splunk_realm",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user or entity that created or triggered the service request, if applicable."
|
||||
},
|
||||
"fieldName": "src_user",
|
||||
"displayName": "src_user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit associated with the user or entity that triggered the service request.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_user_bunit",
|
||||
"displayName": "src_user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category associated with the user or entity that triggered the service request.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_user_category",
|
||||
"displayName": "src_user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority associated with the user or entity that triggered the service request.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_user_priority",
|
||||
"displayName": "src_user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The relative status of the service request."
|
||||
},
|
||||
"fieldName": "status",
|
||||
"displayName": "status",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The time that the src_user submitted the service request."
|
||||
},
|
||||
"fieldName": "time_submitted",
|
||||
"displayName": "time_submitted",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the user or entity that is assigned to carry out the service request, if applicable."
|
||||
},
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The business unit associated with the user or entity that is assigned to carry out the service request, if applicable.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_bunit",
|
||||
"displayName": "user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category associated with the user or entity that is assigned to carry out the service request, if applicable.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_category",
|
||||
"displayName": "user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The priority of the user or entity that is assigned to carry out the service request, if applicable.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_priority",
|
||||
"displayName": "user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "All_Ticket_Management_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The destination of the service request. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name."
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_Ticket_Management_fillnull_ticket_id",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "An identification name, code, or number for the service request."
|
||||
},
|
||||
"fieldName": "ticket_id",
|
||||
"displayName": "ticket_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(ticket_id) OR ticket_id=\"\",\"unknown\",ticket_id)"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Ticket_Management_indexes`) tag=ticketing"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"ticketing",
|
||||
"change"
|
||||
]
|
||||
},
|
||||
"objectName": "Change",
|
||||
"displayName": "Change",
|
||||
"parentName": "All_Ticket_Management",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Change_fillnull_change",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Designation for a request for change (RFC) that is raised to modify an IT service to resolve an incident or problem."
|
||||
},
|
||||
"fieldName": "change",
|
||||
"displayName": "change",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(change) OR change=\"\",\"unknown\",change)"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=change"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"ticketing",
|
||||
"incident"
|
||||
]
|
||||
},
|
||||
"objectName": "Incident",
|
||||
"displayName": "Incident",
|
||||
"parentName": "All_Ticket_Management",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Incident_fillnull_incident",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The incident that triggered the service request. Can be a rare occurrence, or something that happens more frequently An incident that occurs on a frequent basis can also be classified as a problem."
|
||||
},
|
||||
"fieldName": "incident",
|
||||
"displayName": "incident",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(incident) OR incident=\"\",\"unknown\",incident)"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=incident"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"ticketing",
|
||||
"problem"
|
||||
]
|
||||
},
|
||||
"objectName": "Problem",
|
||||
"displayName": "Problem",
|
||||
"parentName": "All_Ticket_Management",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Problem_fillnull_problem",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "When multiple occurrences of related incidents are observed, they are collectively designated with a single problem value. Problem management differs from the process of managing an isolated incident. Often problems are managed by a specific set of staff and through a problem management process."
|
||||
},
|
||||
"fieldName": "problem",
|
||||
"displayName": "problem",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(problem) OR problem=\"\",\"unknown\",problem)"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=problem"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,290 @@
|
||||
{
|
||||
"modelName": "UEBA",
|
||||
"displayName": "User and Entity Behavior Analytics",
|
||||
"description": "User and Entity Behavior Analytics Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"objectName": "All_UEBA_Events",
|
||||
"displayName": "All UEBA Events",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"fieldName": "action",
|
||||
"displayName": "action",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "app",
|
||||
"displayName": "app",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "uba_event_id",
|
||||
"displayName": "uba_event_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "uba_event_type",
|
||||
"displayName": "uba_event_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "category",
|
||||
"displayName": "category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "description",
|
||||
"displayName": "description",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "dvc",
|
||||
"displayName": "dvc",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "link",
|
||||
"displayName": "link",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "severity_id",
|
||||
"displayName": "severity_id",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "severity",
|
||||
"displayName": "severity",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "signature",
|
||||
"displayName": "signature",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "threat_category",
|
||||
"displayName": "threat_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "url",
|
||||
"displayName": "url",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "uba_host",
|
||||
"displayName": "uba_host",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "All_UEBA_Events_uba_time",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "uba_time",
|
||||
"displayName": "uba_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "strptime(uba_time, \"%Y-%m-%d %H:%M:%S %Z\")"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_UEBA_Events_modify_time",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "modify_time",
|
||||
"displayName": "modify_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "strptime(modify_time, \"%Y-%m-%d %H:%M:%S %Z\")"
|
||||
},
|
||||
{
|
||||
"calculationID": "All_UEBA_Events_start_time",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"fieldName": "start_time",
|
||||
"displayName": "start_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "strptime(start_time, \"%Y-%m-%d %H:%M:%S %Z\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "index=ueba (sourcetype=ueba OR sourcetype=uba_threat_json)"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"objectName": "UEBA_Threats",
|
||||
"displayName": "UEBA Threats",
|
||||
"parentName": "All_UEBA_Events",
|
||||
"fields": [
|
||||
{
|
||||
"fieldName": "uba_threat_status",
|
||||
"displayName": "uba_threat_status",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "uba_event_type=threat"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"objectName": "New_UEBA_Threats",
|
||||
"displayName": "New UEBA Threats",
|
||||
"parentName": "UEBA_Threats",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "change_type=new"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"objectName": "UEBA_Anomalies",
|
||||
"displayName": "UEBA Anomalies",
|
||||
"parentName": "All_UEBA_Events",
|
||||
"fields": [
|
||||
{
|
||||
"fieldName": "uba_model",
|
||||
"displayName": "uba_model",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"fieldName": "uba_model_version",
|
||||
"displayName": "uba_model_version",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "uba_event_type=anomaly"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,419 @@
|
||||
{
|
||||
"modelName": "Updates",
|
||||
"displayName": "Updates",
|
||||
"description": "Updates Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"update",
|
||||
"status"
|
||||
]
|
||||
},
|
||||
"objectName": "Updates",
|
||||
"displayName": "Updates",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_should_update",
|
||||
"displayName": "dest_should_update",
|
||||
"type": "boolean",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The device that detected the patch event, such as a patching or configuration management server. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name."
|
||||
},
|
||||
"fieldName": "dvc",
|
||||
"displayName": "dvc",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the patch package that was installed or attempted."
|
||||
},
|
||||
"fieldName": "file_name",
|
||||
"displayName": "file_name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The checksum of the patch package that was installed or attempted."
|
||||
},
|
||||
"fieldName": "file_hash",
|
||||
"displayName": "file_hash",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The severity associated with the patch event.",
|
||||
"expected_values": [
|
||||
"critical",
|
||||
"high",
|
||||
"medium",
|
||||
"low",
|
||||
"informational"
|
||||
]
|
||||
},
|
||||
"fieldName": "severity",
|
||||
"displayName": "severity",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The numeric or vendor specific severity indicator corresponding to the event severity."
|
||||
},
|
||||
"fieldName": "severity_id",
|
||||
"displayName": "severity_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Updates_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The system that is affected by the patch change. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Updates_fillnull_signature",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the patch requirement detected on the client (the dest), such as MS08-067 or RHBA-2013:0739. Note: This is a string value. Use signature_id for numeric or non-human-readable indicators.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "signature",
|
||||
"displayName": "signature",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(signature) AND signature!=\"\",signature,isnotnull(signature_id) AND signature_id!=\"\" AND signature_id!=\"unknown\",signature_id,1=1,\"unknown\")"
|
||||
},
|
||||
{
|
||||
"calculationID": "Updates_fillnull_signature_id",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The ID of the patch requirement detected on the client (the src). Note: Use signature for human-readable signature names.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "signature_id",
|
||||
"displayName": "signature_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(signature_id) AND signature_id!=\"\",signature_id,isnotnull(signature) AND signature!=\"\" AND signature!=\"unknown\",signature,1=1,\"unknown\")"
|
||||
},
|
||||
{
|
||||
"calculationID": "Updates_fillnull_status",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Indicates the status of a given patch requirement.",
|
||||
"expected_values": [
|
||||
"available",
|
||||
"installed",
|
||||
"invalid",
|
||||
"restart required"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "status",
|
||||
"displayName": "status",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(status) OR status=\"\",\"unknown\",status)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Updates_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor and product of the patch monitoring product, such as Lumension Patch Manager. This field can be automatically populated by vendor and product fields in your data.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Updates_indexes`) tag=update tag=status"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"update",
|
||||
"status"
|
||||
]
|
||||
},
|
||||
"objectName": "Available_Updates",
|
||||
"displayName": "Available Updates",
|
||||
"parentName": "Updates",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "status=\"available\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"update",
|
||||
"status"
|
||||
]
|
||||
},
|
||||
"objectName": "Installed_Updates",
|
||||
"displayName": "Installed Updates",
|
||||
"parentName": "Updates",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "status=\"installed\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"update",
|
||||
"status"
|
||||
]
|
||||
},
|
||||
"objectName": "Restart_Required_Updates",
|
||||
"displayName": "Updates Requiring Restart",
|
||||
"parentName": "Updates",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "status=\"restart_required\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"update",
|
||||
"error"
|
||||
]
|
||||
},
|
||||
"objectName": "Update_Errors",
|
||||
"displayName": "Update Errors",
|
||||
"parentName": "BaseSearch",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The event timestamp expressed in Unix time.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "_time",
|
||||
"displayName": "_time",
|
||||
"type": "timestamp",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The host associated with the search.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "host",
|
||||
"displayName": "host",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The source associated with the search.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "source",
|
||||
"displayName": "source",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The source type associated with the search.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "sourcetype",
|
||||
"displayName": "sourcetype",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
|
||||
],
|
||||
"baseSearch": "(`cim_Updates_indexes`) tag=update tag=error",
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,538 @@
|
||||
{
|
||||
"modelName": "Vulnerabilities",
|
||||
"displayName": "Vulnerabilities",
|
||||
"description": "Vulnerabilities Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"vulnerability",
|
||||
"report"
|
||||
]
|
||||
},
|
||||
"objectName": "Vulnerabilities",
|
||||
"displayName": "Vulnerabilities",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "Numeric indicator of the common vulnerability scoring system."
|
||||
},
|
||||
"fieldName": "cvss",
|
||||
"displayName": "cvss",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dvc_bunit",
|
||||
"displayName": "dvc_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dvc_category",
|
||||
"displayName": "dvc_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dvc_priority",
|
||||
"displayName": "dvc_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The numeric or vendor specific severity indicator corresponding to the event severity."
|
||||
},
|
||||
"fieldName": "severity_id",
|
||||
"displayName": "severity_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The unique identifier or event code of the event signature."
|
||||
},
|
||||
"fieldName": "signature_id",
|
||||
"displayName": "signature_id",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The URL involved in the discovered vulnerability."
|
||||
},
|
||||
"fieldName": "url",
|
||||
"displayName": "url",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user involved in the discovered vulnerability."
|
||||
},
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_bunit",
|
||||
"displayName": "user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_category",
|
||||
"displayName": "user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_priority",
|
||||
"displayName": "user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Vulnerabilities_lower_bugtraq",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The identifier in the vulnerability database provided by the Security Focus website (searchable at http:\/\/www.securityfocus.com\/)."
|
||||
},
|
||||
"fieldName": "bugtraq",
|
||||
"displayName": "bugtraq",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnotnull(bugtraq) AND bugtraq!=\"\",lower(bugtraq),null())"
|
||||
},
|
||||
{
|
||||
"calculationID": "Vulnerabilities_fillnull_category",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of the discovered vulnerability, such as DoS. Note: This field is a string. Use category_id for numeric values. The category_id field is optional and thus is not included in the data model.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "category",
|
||||
"displayName": "category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(category) OR category=\"\",\"unknown\",category)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Vulnerabilities_lower_cert",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The identifier in the vulnerability database provided by the US Computer Emergency Readiness Team (US-CERT, searchable at http:\/\/www.kb.cert.org\/vuls\/)."
|
||||
},
|
||||
"fieldName": "cert",
|
||||
"displayName": "cert",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnotnull(cert) AND cert!=\"\",lower(cert),null())"
|
||||
},
|
||||
{
|
||||
"calculationID": "Vulnerabilities_lower_cve",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The identifier provided in the Common Vulnerabilities and Exposures index (searchable at http:\/\/cve.mitre.org).",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "cve",
|
||||
"displayName": "cve",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnotnull(cve) AND cve!=\"\",lower(cve),null())"
|
||||
},
|
||||
{
|
||||
"calculationID": "Vulnerabilities_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The host with the discovered vulnerability. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Vulnerabilities_fillnull_dvc",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The system that discovered the vulnerability. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dvc",
|
||||
"displayName": "dvc",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Vulnerabilities_lower_msft",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The Microsoft Security Advisory number (http:\/\/technet.microsoft.com\/en-us\/security\/advisory\/)."
|
||||
},
|
||||
"fieldName": "msft",
|
||||
"displayName": "msft",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnotnull(msft) AND msft!=\"\",lower(msft),null())"
|
||||
},
|
||||
{
|
||||
"calculationID": "Vulnerabilities_lower_mskb",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The Microsoft Knowledge Base article number (http:\/\/support.microsoft.com\/kb\/)."
|
||||
},
|
||||
"fieldName": "mskb",
|
||||
"displayName": "mskb",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnotnull(mskb) AND mskb!=\"\",lower(mskb),null())"
|
||||
},
|
||||
{
|
||||
"calculationID": "Vulnerabilities_fillnull_severity",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The severity of the vulnerability detection event. Specific values are required. Use vendor_severity for the vendor's own human readable strings (such as Good, Bad, and Really Bad). Note: This field is a string. Use severity_id for numeric data types. The severity_id field is optional and not included in the data model.",
|
||||
"expected_values": [
|
||||
"critical",
|
||||
"high",
|
||||
"medium",
|
||||
"low",
|
||||
"informational"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "severity",
|
||||
"displayName": "severity",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Vulnerabilities_fillnull_signature",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the vulnerability detected on the host, such as HPSBMU02785 SSRT100526 rev.2 - HP LoadRunner Running on Windows, Remote Execution of Arbitrary Code, Denial of Service (DoS). Note: This field has a string value. Use signature_id for numeric indicators. The signature_id field is optional and thus is not included in the data model.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "signature",
|
||||
"displayName": "signature",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Vulnerabilities_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor and product that detected the vulnerability. This field can be automatically populated by vendor and product fields in your data.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
},
|
||||
{
|
||||
"calculationID": "Vulnerabilities_lower_xref",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "A cross-reference identifier associated with the vulnerability. In most cases, the xref field contains both the short name of the database being cross-referenced and the unique identifier used in the external database."
|
||||
},
|
||||
"fieldName": "xref",
|
||||
"displayName": "xref",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnotnull(xref) AND xref!=\"\",lower(xref),null())"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Vulnerabilities_indexes`) tag=vulnerability tag=report"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"vulnerability",
|
||||
"report"
|
||||
]
|
||||
},
|
||||
"objectName": "High_Critical_Vulnerabilities",
|
||||
"displayName": "High Or Critical Vulnerabilities",
|
||||
"parentName": "Vulnerabilities",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(severity=\"high\" OR severity=\"critical\")"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"vulnerability",
|
||||
"report"
|
||||
]
|
||||
},
|
||||
"objectName": "Medium_Vulnerabilities",
|
||||
"displayName": "Medium Vulnerabilities",
|
||||
"parentName": "Vulnerabilities",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "severity=\"medium\""
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"vulnerability",
|
||||
"report"
|
||||
]
|
||||
},
|
||||
"objectName": "Low_Informational_Vulnerabilities",
|
||||
"displayName": "Low Or Informational Vulnerabilities",
|
||||
"parentName": "Vulnerabilities",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(severity=\"low\" OR severity=\"informational\")"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,806 @@
|
||||
{
|
||||
"modelName": "Web",
|
||||
"displayName": "Web",
|
||||
"description": "Web Data Model",
|
||||
"editable": false,
|
||||
"objects": [
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"web"
|
||||
]
|
||||
},
|
||||
"objectName": "Web",
|
||||
"displayName": "Web",
|
||||
"parentName": "BaseEvent",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The application detected or hosted by the server/site such as wordpress, splunk, or facebook."
|
||||
},
|
||||
"fieldName": "app",
|
||||
"displayName": "app",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "Indicates whether the event data is cached or not.",
|
||||
"expected_values": [
|
||||
"true",
|
||||
"false",
|
||||
"1",
|
||||
"0"
|
||||
]
|
||||
},
|
||||
"fieldName": "cached",
|
||||
"displayName": "cached",
|
||||
"type": "boolean",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The category of traffic, such as may be provided by a proxy server."
|
||||
},
|
||||
"fieldName": "category",
|
||||
"displayName": "category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The cookie file recorded in the event."
|
||||
},
|
||||
"fieldName": "cookie",
|
||||
"displayName": "cookie",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_bunit",
|
||||
"displayName": "dest_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_category",
|
||||
"displayName": "dest_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The destination port of the web traffic."
|
||||
},
|
||||
"fieldName": "dest_port",
|
||||
"displayName": "dest_port",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "dest_priority",
|
||||
"displayName": "dest_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The time taken by the proxy event, in milliseconds."
|
||||
},
|
||||
"fieldName": "duration",
|
||||
"displayName": "duration",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The amount of time it took to receive a response, if applicable, in milliseconds."
|
||||
},
|
||||
"fieldName": "response_time",
|
||||
"displayName": "response_time",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The virtual site which services the request, if applicable."
|
||||
},
|
||||
"fieldName": "site",
|
||||
"displayName": "site",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_bunit",
|
||||
"displayName": "src_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_category",
|
||||
"displayName": "src_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "src_priority",
|
||||
"displayName": "src_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "tag",
|
||||
"displayName": "tag",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The path of the resource served by the webserver or proxy."
|
||||
},
|
||||
"fieldName": "uri_path",
|
||||
"displayName": "uri_path",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The path of the resource requested by the client."
|
||||
},
|
||||
"fieldName": "uri_query",
|
||||
"displayName": "uri_query",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_bunit",
|
||||
"displayName": "user_bunit",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_category",
|
||||
"displayName": "user_category",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": true,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "user_priority",
|
||||
"displayName": "user_priority",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
{
|
||||
"calculationID": "Web_fillnull_action",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The action taken by the server or proxy.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "action",
|
||||
"displayName": "action",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(action) OR action=\"\",\"unknown\",action)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Web_bytes",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The total number of bytes transferred (bytes_in + bytes_out).",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "bytes",
|
||||
"displayName": "bytes",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnum(bytes),bytes,isnum(bytes_in) AND isnum(bytes_out),bytes_in+bytes_out,1=1,null())"
|
||||
},
|
||||
{
|
||||
"calculationID": "Web_bytes_in",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The number of inbound bytes transferred.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "bytes_in",
|
||||
"displayName": "bytes_in",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnum(bytes_in),bytes_in,isnum(bytes) AND isnum(bytes_out),bytes-bytes_out,1=1,null())"
|
||||
},
|
||||
{
|
||||
"calculationID": "Web_bytes_out",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The number of outbound bytes transferred.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "bytes_out",
|
||||
"displayName": "bytes_out",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnum(bytes_out),bytes_out,isnum(bytes) AND isnum(bytes_in),bytes-bytes_in,1=1,null())"
|
||||
},
|
||||
{
|
||||
"calculationID": "Web_fillnull_dest",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The destination of the network traffic (the remote host). You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "dest",
|
||||
"displayName": "dest",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(dest) OR dest=\"\" OR dest=\"-\",\"unknown\",dest)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Web_fillnull_http_content_type",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The content-type of the requested HTTP resource.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "http_content_type",
|
||||
"displayName": "http_content_type",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(http_content_type) OR http_content_type=\"\" OR http_content_type=\"-\",\"unknown\",http_content_type)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Web_fillnull_http_method",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The HTTP method used in the request.",
|
||||
"expected_values": [
|
||||
"GET",
|
||||
"PUT",
|
||||
"POST",
|
||||
"DELETE",
|
||||
"HEAD",
|
||||
"OPTIONS",
|
||||
"CONNECT",
|
||||
"TRACE"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "http_method",
|
||||
"displayName": "http_method",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(http_method) OR http_method=\"\" OR http_method=\"-\",\"unknown\",http_method)"
|
||||
},
|
||||
{
|
||||
"calculationID": "0Web_fillnull_http_referrer",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The HTTP referrer used in the request. The W3C specification and many implementations misspell this as http_referer. Use a FIELDALIAS to handle both key names.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "http_referrer",
|
||||
"displayName": "http_referrer",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(http_referrer) OR http_referrer=\"\" OR http_referrer=\"-\",\"unknown\",http_referrer)"
|
||||
},
|
||||
{
|
||||
"calculationID": "1Web_http_referrer_domain",
|
||||
"calculationType": "Rex",
|
||||
"inputField": "http_referrer",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The domain name contained within the HTTP referrer used in the request.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "http_referrer_domain",
|
||||
"displayName": "http_referrer_domain",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "^(?:http|https|ftp):\\\/\\\/(?:[a-zA-Z0-9\\.\\-]+(?::[a-zA-Z0-9]+)?@)?(?<http_referrer_domain>[^\\\/:]+)(?::[0-9]+)?"
|
||||
},
|
||||
{
|
||||
"calculationID": "Web_fillnull_http_user_agent",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user agent used in the request.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "http_user_agent",
|
||||
"displayName": "http_user_agent",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(http_user_agent) OR http_user_agent=\"\" OR http_user_agent=\"-\",\"unknown\",http_user_agent)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Web_http_user_agent_length",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The length of the user agent used in the request.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "http_user_agent_length",
|
||||
"displayName": "http_user_agent_length",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "len(http_user_agent)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Web_fillnull_src",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The source of the network traffic (the client requesting the connection).",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "src",
|
||||
"displayName": "src",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(src) OR src=\"\" OR src=\"-\",\"unknown\",src)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Web_fillnull_status",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The HTTP response code indicating the status of the proxy request.",
|
||||
"expected_values": [
|
||||
"100",
|
||||
"101",
|
||||
"102",
|
||||
"200",
|
||||
"201",
|
||||
"202",
|
||||
"203",
|
||||
"204",
|
||||
"205",
|
||||
"206",
|
||||
"207",
|
||||
"208",
|
||||
"226",
|
||||
"300",
|
||||
"301",
|
||||
"302",
|
||||
"303",
|
||||
"304",
|
||||
"305",
|
||||
"306",
|
||||
"307",
|
||||
"308",
|
||||
"400",
|
||||
"401",
|
||||
"402",
|
||||
"403",
|
||||
"404",
|
||||
"405",
|
||||
"406",
|
||||
"407",
|
||||
"408",
|
||||
"409",
|
||||
"410",
|
||||
"411",
|
||||
"412",
|
||||
"413",
|
||||
"414",
|
||||
"415",
|
||||
"416",
|
||||
"417",
|
||||
"422",
|
||||
"423",
|
||||
"424",
|
||||
"426",
|
||||
"428",
|
||||
"429",
|
||||
"431",
|
||||
"500",
|
||||
"501",
|
||||
"502",
|
||||
"503",
|
||||
"504",
|
||||
"505",
|
||||
"506",
|
||||
"507",
|
||||
"508",
|
||||
"510",
|
||||
"511"
|
||||
],
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "status",
|
||||
"displayName": "status",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(status) OR status=\"\" OR status=\"-\",\"unknown\",status)"
|
||||
},
|
||||
{
|
||||
"calculationID": "0Web_fillnull_url",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The URL of the requested HTTP resource.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "url",
|
||||
"displayName": "url",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(url) OR url=\"\" OR url=\"-\",\"unknown\",url)"
|
||||
},
|
||||
{
|
||||
"calculationID": "1Web_url_domain",
|
||||
"calculationType": "Rex",
|
||||
"inputField": "url",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The domain name contained within the URL of the requested HTTP resource.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "url_domain",
|
||||
"displayName": "url_domain",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "^(?:http|https|ftp):\\\/\\\/(?:[a-zA-Z0-9\\.\\-]+(?::[a-zA-Z0-9]+)?@)?(?<url_domain>[^\\\/:]+)(?::[0-9]+)?"
|
||||
},
|
||||
{
|
||||
"calculationID": "2Web_url_length",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The length of the URL.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "url_length",
|
||||
"displayName": "url_length",
|
||||
"type": "number",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "len(url)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Web_fillnull_user",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The user that requested the HTTP resource.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "user",
|
||||
"displayName": "user",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "if(isnull(user) OR user=\"\",\"unknown\",user)"
|
||||
},
|
||||
{
|
||||
"calculationID": "Web_vendor_product",
|
||||
"calculationType": "Eval",
|
||||
"outputFields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The vendor and product of the proxy server, such as Squid Proxy Server. This field can be automatically populated by vendor and product fields in your data.",
|
||||
"recommended": true
|
||||
},
|
||||
"fieldName": "vendor_product",
|
||||
"displayName": "vendor_product",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
|
||||
}
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "(`cim_Web_indexes`) tag=web"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"web",
|
||||
"proxy"
|
||||
]
|
||||
},
|
||||
"objectName": "Proxy",
|
||||
"displayName": "Proxy",
|
||||
"parentName": "Web",
|
||||
"fields": [
|
||||
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=proxy"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"tags": [
|
||||
"web",
|
||||
"storage"
|
||||
]
|
||||
},
|
||||
"objectName": "Storage",
|
||||
"displayName": "Storage",
|
||||
"parentName": "Web",
|
||||
"fields": [
|
||||
{
|
||||
"comment": {
|
||||
"description": "The name of the bucket or storage account.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "storage_name",
|
||||
"displayName": "storage_name",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The operation performed on the storage account.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "operation",
|
||||
"displayName": "operation",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"comment": {
|
||||
"description": "The error code that occurred while accessing the storage account.",
|
||||
"ta_relevant": false
|
||||
},
|
||||
"fieldName": "error_code",
|
||||
"displayName": "error_code",
|
||||
"type": "string",
|
||||
"fieldSearch": "",
|
||||
"required": false,
|
||||
"multivalue": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"calculations": [
|
||||
|
||||
],
|
||||
"constraints": [
|
||||
{
|
||||
"search": "tag=storage"
|
||||
}
|
||||
],
|
||||
"children": [
|
||||
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user