From da30ab13bbc67ac596a25dcb0fa7a9e557486b20 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 26 Jul 2022 15:38:29 -0700 Subject: [PATCH] Add the initial cut at datamodel and yaml parser. Include all of the datamodels, with the Risk.json and EUBA.json models as well. --- bin/datamodel_parser.py | 363 ++ bin/datamodels/Alerts.json | 468 +++ bin/datamodels/Application_State.json | 502 +++ bin/datamodels/Authentication.json | 752 ++++ bin/datamodels/Certificates.json | 696 ++++ bin/datamodels/Change.json | 1134 ++++++ bin/datamodels/Change_Analysis.json | 1088 ++++++ bin/datamodels/Compute_Inventory.json | 1039 ++++++ bin/datamodels/DLP.json | 591 ++++ bin/datamodels/Data_Access.json | 463 +++ bin/datamodels/Databases.json | 1139 ++++++ bin/datamodels/Email.json | 825 +++++ bin/datamodels/Endpoint.json | 2269 ++++++++++++ bin/datamodels/Event_Signatures.json | 136 + bin/datamodels/Interprocess_Messaging.json | 462 +++ bin/datamodels/Intrusion_Detection.json | 583 ++++ bin/datamodels/JVM.json | 824 +++++ bin/datamodels/Malware.json | 723 ++++ bin/datamodels/Network_Resolution.json | 506 +++ bin/datamodels/Network_Sessions.json | 516 +++ bin/datamodels/Network_Traffic.json | 1026 ++++++ bin/datamodels/Performance.json | 844 +++++ bin/datamodels/Risk.json | 563 +++ bin/datamodels/Splunk_Audit.json | 1303 +++++++ bin/datamodels/Splunk_CIM_Validation.json | 3648 ++++++++++++++++++++ bin/datamodels/Ticket_Management.json | 462 +++ bin/datamodels/UEBA.json | 290 ++ bin/datamodels/Updates.json | 419 +++ bin/datamodels/Vulnerabilities.json | 538 +++ bin/datamodels/Web.json | 806 +++++ 30 files changed, 24978 insertions(+) create mode 100644 bin/datamodel_parser.py create mode 100644 bin/datamodels/Alerts.json create mode 100644 bin/datamodels/Application_State.json create mode 100644 bin/datamodels/Authentication.json create mode 100644 bin/datamodels/Certificates.json create mode 100644 bin/datamodels/Change.json create mode 100644 bin/datamodels/Change_Analysis.json create mode 100644 bin/datamodels/Compute_Inventory.json create mode 100644 bin/datamodels/DLP.json create mode 100644 bin/datamodels/Data_Access.json create mode 100644 bin/datamodels/Databases.json create mode 100644 bin/datamodels/Email.json create mode 100644 bin/datamodels/Endpoint.json create mode 100644 bin/datamodels/Event_Signatures.json create mode 100644 bin/datamodels/Interprocess_Messaging.json create mode 100644 bin/datamodels/Intrusion_Detection.json create mode 100644 bin/datamodels/JVM.json create mode 100644 bin/datamodels/Malware.json create mode 100644 bin/datamodels/Network_Resolution.json create mode 100644 bin/datamodels/Network_Sessions.json create mode 100644 bin/datamodels/Network_Traffic.json create mode 100644 bin/datamodels/Performance.json create mode 100644 bin/datamodels/Risk.json create mode 100644 bin/datamodels/Splunk_Audit.json create mode 100644 bin/datamodels/Splunk_CIM_Validation.json create mode 100644 bin/datamodels/Ticket_Management.json create mode 100644 bin/datamodels/UEBA.json create mode 100644 bin/datamodels/Updates.json create mode 100644 bin/datamodels/Vulnerabilities.json create mode 100644 bin/datamodels/Web.json diff --git a/bin/datamodel_parser.py b/bin/datamodel_parser.py new file mode 100644 index 0000000000..4c99b34152 --- /dev/null +++ b/bin/datamodel_parser.py @@ -0,0 +1,363 @@ +from curses.ascii import TAB +from dataclasses import dataclass, field +import json +import pathlib +import sys +import re + +TAB_CHARACTER='\t' + +DATAMODEL_PATTERN = r"datamodel\s*=\s*\S*" +QUOTATIONS_PATTERN = r'''(["'])(?:(?=(\\?))\2.)*?\1''' +KEY_VALUE_PATTERN = r"[a-zA-Z0-9_]+\.[a-zA-Z0-9_]+" + +class DatamodelRoot: + def __init__(self, paths:list[pathlib.Path]): + self.datamodels = {} + for p in paths: + if p.is_file(): + self.add_datamodel_file(p) + elif p.is_dir(): + self.add_datamodel_directory(p) + else: + raise(Exception(f"Path {p} is neither a directory nor a path")) + + print(f"Processed [{len(self.datamodels)}] datamodels") + + def add_datamodel_file(self, path:pathlib.Path)->None: + dm = Datamodel(path) + self.datamodels[dm.name] = dm + + def add_datamodel_directory(self, directory_path:pathlib.Path)->None: + for filePath in directory_path.rglob("*.json"): + self.add_datamodel_file(filePath) + + def pretty_print(self, indent_spaces:int = 3): + for dm_name, dm_obj in self.datamodels.items(): + print(f"{dm_obj.name} - {dm_obj.path}") + + for object_name, object_item in dm_obj.objects.items(): + print(' ' * (indent_spaces*1) + object_item.name) + for field_name, field_object in object_item.fields.items(): + print(' ' * (indent_spaces*2) + field_object.name) + + def resolve_fieldname(self, full_path:str)->list[str]: + + segments = full_path.split('.') + if len(segments) == 3: + paths = self.resolve_three_part_field_name(segments[0], segments[1], segments[2]) + + elif len(segments) == 2: + paths = self.resolve_two_part_field_name(segments[0], segments[1]) + elif len(segments) == 1: + paths = self.resolve_one_part_field_name(segments[0]) + else: + raise(Exception(f"Could not resolve the reference to {full_path} in any datamodel")) + + #if len(paths) == 0: + # print(f"Failed to find [{full_path}]") + return sorted(paths) + + def resolve_three_part_field_name(self, datamodelName:str, submodelName:str, fieldName:str)->list[str]: + paths = [] + if datamodelName in self.datamodels: + dm = self.datamodels[datamodelName] + if submodelName in dm.objects: + objs = dm.objects[submodelName] + if fieldName in objs.fields: + field = objs.fields[fieldName] + paths.append(f"{dm.name}.{objs.name}.{field.name}") + return paths + + def resolve_two_part_field_name(self, submodelName:str, fieldName:str)->list[str]: + paths = [] + for dm_name in self.datamodels: + paths += self.resolve_three_part_field_name(dm_name, submodelName, fieldName) + return paths + + def resolve_one_part_field_name(self, fieldName:str)->list[str]: + paths = [] + for dmName, dmObject in self.datamodels.items(): + for objectName, objectObject in dmObject.objects.items(): + paths += self.resolve_three_part_field_name(dmName, objectName, fieldName) + return paths + + def validate_model_and_submodel(self, modelAndSubmodel:str)->bool: + parts = modelAndSubmodel.split('.') + if len(parts) == 1: + model = parts[0] + if model in self.datamodels: + return True + elif len(parts) == 2: + model = parts[0] + submodel = parts[1] + if model in self.datamodels: + if submodel in self.datamodels[model].objects: + return True + else: + raise(Exception(f"Submodel {submodel} not found in the {model} Datamodel: {self.datamodels[model].objects.keys()}")) + else: + raise(Exception(f"Model {model} not found in the valid datamodels: {self.datamodels.keys()}")) + + else: + raise(Exception(f"The datamodel {modelAndSubmodel} was not in the expected format of 'model[.submodel]'")) + + + raise(Exception(f"The datamodel {modelAndSubmodel} was not found in the defined datamodels and submodels")) + +class Datamodel: + def __init__(self, path:pathlib.Path): + self.path = path + with open(path, 'r') as datamodel_file: + model = json.load(datamodel_file) + + #print(f"Parsing Datamodel [{model['modelName']}]...") + self.name = model['modelName'] + self.objects = {} + if 'objects' in model: + self.parse_objects(model['objects']) + else: + raise(Exception(f"Datamodel file [{self.path}] did not contain 'objects'")) + + + + def parse_objects(self, json_objects: list,depth:int=0): + for json_object in json_objects: + datamodel_object = DatamodelObject(json_object) + self.objects[datamodel_object.name] = datamodel_object + + +class DatamodelObject: + def __init__(self, datamodel_object: dict): + + self.name = datamodel_object['objectName'] + self.fields = {} + if 'fields' in datamodel_object: + self.parse_fields(datamodel_object['fields']) + #else: + # print(f"'fields' not found in datamodel object {self.name}") + if 'calculations' in datamodel_object: + self.parse_calculations(datamodel_object['calculations']) + #else: + # print(f"'calculations' not found in datamodel object {self.name}") + + def parse_fields(self, fields_object: list): + for field in fields_object: + field = DatamodelField(field) + self.fields[field.name] = field + def parse_calculations(self, calculations_object: list): + for calculation in calculations_object: + self.parse_fields(calculation['outputFields']) + + + + +class DatamodelField: + def __init__(self, datamodel_field: dict): + self.name = datamodel_field['fieldName'] +#class DatamodelCalculation: +# def __init__(self, datamodel_calculation: dict): +# self.name = datamodel_calculation[] +# pass + + +class SearchFieldValidator: + def __init__(self, path:pathlib.Path, yaml_search:str, yaml_datamodels: set[str], yaml_required_fields: set[str], datamodelRoot: DatamodelRoot, errorOnMissingSubmodel:bool=True): + self.path = path + self.yaml_search = yaml_search + self.yaml_datamodels = yaml_datamodels + self.yaml_required_fields = yaml_required_fields + self.errorOnMissingSubmodel = errorOnMissingSubmodel + self.datamodelRoot = datamodelRoot + self.datamodels_declared_in_search = self.extractDatamodelsFromSearch() + self.fields_from_search = self.extractFieldsFromSearch() + + self.datamodels_used_in_search = set() + + + #print("Datamodels:") + #print(self.search_datamodels_from_search) + #print("Fields:") + #print(self.fields_from_search) + self.updated = False + self.valid_search = self.validate_search() + + if self.updated: + print("yes, it was updated") + + def extractDatamodelsFromSearch(self, interactive:bool=False)->set[str]: + #First search includes the beginning datamodel= (including whitespace) + all_data_models = re.findall(DATAMODEL_PATTERN, self.yaml_search) + + #Trim off the beginning datamodel= and leading and trailing + cleaned_models = set() + for datamodel in all_data_models: + try: + equals_and_datamodel = datamodel.split('=') + + if len(equals_and_datamodel) != 2: + #print("\n") + #print(self.yaml_search) + #print(datamodel) + #print(equals_and_datamodel) + #sys.exit(1) + raise(Exception(f"Expected format 'datamodel=Model.submodel' but received {datamodel}, parsed as {equals_and_datamodel}")) + + cleaned_datamodel = equals_and_datamodel[1].strip().rstrip() + if '.' not in cleaned_datamodel and self.errorOnMissingSubmodel: + #raise(Exception(f"No submodel contained in datamodel [{datamodel}]")) + pass + if not self.datamodelRoot.validate_model_and_submodel(cleaned_datamodel): + raise(Exception(f"The datamodel and submodel {cleaned_datamodel} do not exist in the parsed datamodels")) + cleaned_models.add(cleaned_datamodel) + + + except Exception as e: + raise(Exception(f"Error trying to extract the Datamodel from datamodel [{datamodel}]: {str(e)}")) + return cleaned_models + + + def extractFieldsFromSearch(self)->list[str]: + #First, remove the datamodel(s) from the search + all_data_models = re.findall(DATAMODEL_PATTERN, self.yaml_search) + search_without_datamodels = self.yaml_search + for dms in all_data_models: + search_without_datamodels = search_without_datamodels.replace(dms, "") + + #Remove all of the quoted text. We do this because things like cmd.exe could be + #interpreted as a field. In reality, we need to quote these in the raw files + #so that they can be removed during this step + search_without_quoted_text = re.sub(QUOTATIONS_PATTERN, "", search_without_datamodels) + return re.findall(KEY_VALUE_PATTERN, search_without_quoted_text) + + def validate_search(self, interactive:bool = False)->bool: + validation_success = True + + for fieldname in self.fields_from_search: + print(fieldname) + found_fields = self.datamodelRoot.resolve_fieldname(fieldname) + if len(found_fields) == 0: + print(f"Failed to validate field name [{fieldname}] - field does not exist in any datamodels") + validation_success = False + elif len(found_fields) > 1: + print(f"Failed to validate field name [{fieldname}] - field exists in more than one datamodel: {found_fields}") + validation_success = False + else: + fully_qualified_field = found_fields[0] + model = fully_qualified_field.split('.')[0] + modelAndSubmodel = ".".join(fully_qualified_field.split('.')[0:2]) + self.datamodels_used_in_search.add(modelAndSubmodel) + + if self.datamodels_used_in_search != self.datamodels_declared_in_search != self.yaml_datamodels: + print(f"Difference between declared datamodels and used datamodels in {self.path}") + print(f"1) Parsed from YAML Field: {self.yaml_datamodels}") + print(f"2) Declared in Search : {self.datamodels_declared_in_search}") + print(f"3) Extracted from Search : {self.datamodels_used_in_search}") + print('\n') + if interactive: + dm_choices = [1,2,3] + choice = input(f"Which one do you want to keep {dm_choices}: ") + if choice == '1': + print("No change") + self.updated = False + elif choice == '2': + self.updated = True + elif choice == '3': + self.updated = True + else: + raise(Exception(f"Bad choice: {choice}, not one of {dm_choices}")) + + + + + + + ''' + print(f"Was validation successful? {validation_success}") + #print(self.fields_from_search) + print(self.datamodels_declared_in_search) + print(self.datamodels_used_in_search) + if self.datamodels_declared_in_search != self.datamodels_used_in_search != self.yaml_datamodels: + print("Difference between the datamodels declared in the search and the datamodels used in the search") + print(f"FROM : {self.datamodels_declared_in_search}") + print(f"USED : {self.datamodels_used_in_search}") + print(f"YAML : {self.yaml_datamodels}") + ''' + + + + + return validation_success + + + + + return True + + + + + +if __name__ == "__main__": + import sys + datamodel_argument = [sys.argv[1]] + detection_argument = [sys.argv[2]] + interactive = sys.argv[3] + #input_paths = [pathlib.Path(input_path_argument) for input_path_argument in input_path_arguments] + datamodel_paths = [pathlib.Path(input_path_argument) for input_path_argument in datamodel_argument] + root = DatamodelRoot(datamodel_paths) + + + import yaml + detection_paths = [pathlib.Path(detection_path_argument) for detection_path_argument in detection_argument] + + + #glob all the yml files in that directory + + total_searches = 0 + errored_searches = 0 + valid_searches = 0 + failed_searches = 0 + for p in detection_paths: + for filePath in p.rglob("*.yml"): + if "short_lived_windows_account" not in str(filePath): + continue + total_searches += 1 + with open(filePath, 'rb') as detection_data: + try: + dat = yaml.safe_load(detection_data) + search = dat['search'] + decalared_dms = dat['datamodel'] + declared_required_fields = dat['tags']['required_fields'] + #print(filePath) + valid = SearchFieldValidator(filePath, search, decalared_dms, declared_required_fields, root) + if valid.valid_search == True: + valid_searches += 1 + else: + failed_searches += 1 + + except Exception as e: + print(f"Error testing [{filePath}]: {str(e)}") + errored_searches += 1 + + print("Summary") + print(f"Total Searches: {total_searches: >4}") + print(f"Passed Searches: {valid_searches: >4}") + print(f"Failed Searches: {failed_searches: >4}") + print(f"Errored Searches: {errored_searches: >4}") + + + ''' + example_search = '| tstats `security_content_summariesonly` values(All_Changes.result_id) as\ + result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change\ + where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h\ + All_Changes.user All_Changes.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`\ + | `drop_dm_object_name("All_Changes")` | search result_id = 4720 result_id=4726\ + | transaction user connected=false maxspan=240m | table firstTime lastTime count\ + user dest result_id | `short_lived_windows_accounts_filter`' + example_datamodels = {"Change"} + example_required_fields = {"_time", "All_Changes.result_id", "All_Changes.user","All_Changes.dest"} + example_path_string = "/tmp/scann/security_content/detections/endpoint/short_lived_windows_accounts.yml" + examplePath = pathlib.Path(example_path_string) + s = SearchFieldValidator(examplePath, example_search, example_datamodels, example_required_fields, root) + ''' diff --git a/bin/datamodels/Alerts.json b/bin/datamodels/Alerts.json new file mode 100644 index 0000000000..158f893abf --- /dev/null +++ b/bin/datamodels/Alerts.json @@ -0,0 +1,468 @@ +{ + "modelName": "Alerts", + "displayName": "Alerts", + "description": "Alerts Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "alert" + ] + }, + "objectName": "Alerts", + "displayName": "Alerts", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "This field is deprecated in favor of 'description'." + }, + "fieldName": "body", + "displayName": "body", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The description of the alert event." + }, + "fieldName": "description", + "displayName": "description", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit associated with the destination. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the destination. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the destination. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of the destination object, such as 'instance', 'storage', 'firewall'." + }, + "fieldName": "dest_type", + "displayName": "dest_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier of the alert event." + }, + "fieldName": "id", + "displayName": "id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The MITRE ATT&CK technique ID of the alert event, searchable at https:\/\/attack.mitre.org\/techniques" + }, + "fieldName": "mitre_technique_id", + "displayName": "mitre_technique_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The human-friendly title of the alert event, such as 'API GetAccountPasswordPolicy was invoked using root credentials.' Split by signature_id when aggregating alert events by types." + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit associated with the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of the source object, such as 'instance', 'storage', 'firewall'." + }, + "fieldName": "src_type", + "displayName": "src_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is deprecated in favor of 'signature'." + }, + "fieldName": "subject", + "displayName": "subject", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the user involved in the alert event. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the user involved in the alert event. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user involved in the alert event. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The account associated with the alert event." + }, + "fieldName": "vendor_account", + "displayName": "vendor_account", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The data center region involved in the alert event, such as us-west-2." + }, + "fieldName": "vendor_region", + "displayName": "vendor_region", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Alerts_fillnull_app", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system, service, or application that generated the alert event. Examples include, but are not limited to the following: GuardDuty, SecurityCenter, 3rd party services, win:app:trendmicro, vmware, nagios.", + "recommended": true + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(app) OR app=\"\",sourcetype,app)" + }, + { + "calculationID": "Alerts_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The object that is the 'target' of the alert event. Examples include an email address, SNMP trap, or virtual machine id. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Alerts_fillnull_severity", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The severity of the alert event. Note: This field is a string. Specific values are required. Use the severity_id field for severity ID fields that are integer data types. Use vendor_severity for the vendor's own human readable strings (such as 'Good', 'Bad', 'Really Bad').", + "expected_values": [ + "critical", + "high", + "medium", + "low", + "informational", + "unknown" + ], + "recommended": true + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)" + }, + { + "calculationID": "Alerts_fillnull_signature_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor specific policy or rule that generated the alert event, such as 'Policy:IAMUser/RootCredentialUsage.'", + "recommended": true + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(signature_id) OR signature_id=\"\",\"unknown\",signature_id)" + }, + { + "calculationID": "Alerts_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The object that is the 'actor' of the alert event. You can alias or extract this from more specific fields, such as src_host, src_ip, or src_name.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "Alerts_fillnull_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The alert event type.", + "expected_values": [ + "alarm", + "alert", + "event", + "task", + "warning", + "unknown" + ], + "recommended": true + }, + "fieldName": "type", + "displayName": "type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(type) OR type=\"\",\"unknown\",type)" + }, + { + "calculationID": "Alerts_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user involved in the alert event.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Alerts_fillnull_user_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user_name of user involved in the alert event.", + "recommended": true + }, + "fieldName": "user_name", + "displayName": "user_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user_name) OR user_name=\"\",\"unknown\",user_name)" + } + ], + "constraints": [ + { + "search": "(`cim_Alerts_indexes`) tag=alert" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Application_State.json b/bin/datamodels/Application_State.json new file mode 100644 index 0000000000..68dd7a48c4 --- /dev/null +++ b/bin/datamodels/Application_State.json @@ -0,0 +1,502 @@ +{ + "modelName": "Application_State", + "displayName": "Application State (Deprecated)", + "description": "This model has been deprecated", + "editable": false, + "objects": [ + { + "comment": { + "ta_relevant": false + }, + "objectName": "All_Application_State", + "displayName": "All Application State", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The user account the service is running as, such as System or httpdsvc." + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Application_State_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The compute resource where the service is installed. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "All_Application_State_fillnull_process", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of a process or service file, such as sqlsrvr.exe or httpd. Note: This field is not appropriate for service or daemon names, such as SQL Server or Apache Web Server. Service or daemon names belong to the service field.", + "recommended": true + }, + "fieldName": "process", + "displayName": "process", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(process) OR process=\"\",\"unknown\",process)" + }, + { + "calculationID": "All_Application_State_fillnull_process_name", + "calculationType": "Rex", + "outputFields": [ + { + "comment": { + "description": "The name of a process.", + "ta_relevant": false + }, + "fieldName": "process_name", + "displayName": "process_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "inputField": "process", + "expression": "^\\s*(?[^\\s]+)" + } + ], + "constraints": [ + { + "search": "(`cim_Application_State_indexes`) (tag=listening tag=port) OR (tag=process tag=report) OR (tag=service tag=report)" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "listening", + "port" + ] + }, + "objectName": "Ports", + "displayName": "Ports", + "parentName": "All_Application_State", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Ports_fillnull_dest_port", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Network ports communicated to by the process, such as 53.", + "recommended": true + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnum(dest_port),dest_port,0)" + }, + { + "calculationID": "Ports_fillnull_transport", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The network ports listened to by the application process, such as tcp, udp, etc.", + "recommended": true + }, + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(transport) OR transport=\"\",\"unknown\",lower(transport))" + }, + { + "calculationID": "Ports_transport_dest_port", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Calculated as transport\/dest_port, such as tcp\/53.", + "ta_relevant": false + }, + "fieldName": "transport_dest_port", + "displayName": "transport_dest_port", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(transport_dest_port) OR transport_dest_port=\"\",split(replace(mvjoin(mvzip(transport,dest_port),\"|\"),\",\",\"\/\"),\"|\"),transport_dest_port)" + } + ], + "constraints": [ + { + "search": "tag=listening tag=port" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "process", + "report" + ] + }, + "objectName": "Processes", + "displayName": "Processes", + "parentName": "All_Application_State", + "fields": [ + { + "comment": { + "description": "CPU Load in megahertz." + }, + "fieldName": "cpu_load_mhz", + "displayName": "cpu_load_mhz", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "CPU Load in percent." + }, + "fieldName": "cpu_load_percent", + "displayName": "cpu_load_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "CPU Time." + }, + "fieldName": "cpu_time", + "displayName": "cpu_time", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Memory used in bytes." + }, + "fieldName": "mem_used", + "displayName": "mem_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=process tag=report" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "service", + "report" + ] + }, + "objectName": "Services", + "displayName": "Services", + "parentName": "All_Application_State", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Services_fillnull_service", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the service, such as SQL Server or Apache Web Server. Note: This field is not appropriate for filenames, such as sqlsrvr.exe or httpd. Filenames should belong to the process field instead. Also, note that field is a string. Use the service_id field for service ID fields that are integer data types.", + "recommended": true + }, + "fieldName": "service", + "displayName": "service", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(service) OR service=\"\",\"unknown\",service)" + }, + { + "calculationID": "Services_fillnull_service_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "A numeric indicator for a service.", + "recommended": true + }, + "fieldName": "service_id", + "displayName": "service_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(service_id) OR service_id=\"\",\"unknown\",service_id)" + }, + { + "calculationID": "Services_fillnull_start_mode", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The start mode for the service.", + "expected_values": [ + "disabled", + "manual", + "auto" + ], + "recommended": true + }, + "fieldName": "start_mode", + "displayName": "start_mode", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(start_mode) OR start_mode=\"\",\"unknown\",start_mode)" + }, + { + "calculationID": "Services_fillnull_status", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The status of the service.", + "expected_values": [ + "critical", + "started", + "stopped", + "warning" + ], + "recommended": true + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(status) OR status=\"\",\"unknown\",status)" + } + ], + "constraints": [ + { + "search": "tag=service tag=report" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Authentication.json b/bin/datamodels/Authentication.json new file mode 100644 index 0000000000..fb42d26048 --- /dev/null +++ b/bin/datamodels/Authentication.json @@ -0,0 +1,752 @@ +{ + "modelName": "Authentication", + "displayName": "Authentication", + "description": "Authentication Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "authentication" + ] + }, + "objectName": "Authentication", + "displayName": "Authentication", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The method used to authenticate the request such as SAML, FIDO, or MFA." + }, + "fieldName": "authentication_method", + "displayName": "authentication_method", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The service used to authenticate the request such as Okta, or ActiveDirectory" + }, + "fieldName": "authentication_service", + "displayName": "authentication_service", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the authentication target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the authentication target, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The name of the Active Directory used by the authentication target, if applicable." + }, + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the authentication target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time for the completion of the authentication event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The human-readable message associated with the authentication action (success or failure)." + }, + "fieldName": "reason", + "displayName": "reason", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response in the authentication event, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A human-readable signature name." + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the authentication source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the authentication source, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The name of the Active Directory used by the authentication source, if applicable." + }, + "fieldName": "src_nt_domain", + "displayName": "src_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the authentication source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_bunit", + "displayName": "src_user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_category", + "displayName": "src_user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed." + }, + "fieldName": "src_user_id", + "displayName": "src_user_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_priority", + "displayName": "src_user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The role of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed." + }, + "fieldName": "src_user_role", + "displayName": "src_user_role", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed." + }, + "fieldName": "src_user_type", + "displayName": "src_user_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The user agent through which the request was made, such as Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) or aws-cli/2.0.0 Python/3.7.4 Darwin/18.7.0 botocore/2.0.0dev4." + }, + "fieldName": "user_agent", + "displayName": "user_agent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the user involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the user involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The unique id of the user involved in the event. For authentication privilege escalation events, this should represent the user targeted by the escalation." + }, + "fieldName": "user_id", + "displayName": "user_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user involved in the event, or who initiated the event. For authentication privilege escalation events, this should represent the user priority targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The role of the user involved in the event, or who initiated the event. For authentication privilege escalation events, this should represent the user role targeted by the escalation." + }, + "fieldName": "user_role", + "displayName": "user_role", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of the user involved in the event or who initiated the event, such as IAMUser, Admin, or System. For authentication privilege escalation events, this should represent the user type targeted by the escalation." + }, + "fieldName": "user_type", + "displayName": "user_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The account that manages the user that initiated the request." + }, + "fieldName": "vendor_account", + "displayName": "vendor_account", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Authentication_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action performed on the resource.", + "expected_values": [ + "success", + "failure", + "pending", + "error" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Authentication_fillnull_app", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The application involved in the event, such as ssh, splunk, win:local.", + "recommended": true + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(app) OR app=\"\",sourcetype,app)" + }, + { + "calculationID": "Authentication_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source involved in the authentication. In the case of endpoint protection authentication the src is the client. You can alias this from more specific fields, such as src_host, src_ip, or src_nt_host.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "Authentication_fillnull_src_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "In privilege escalation events, src_user represents the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.", + "recommended": true + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_user) OR src_user=\"\",\"unknown\",src_user)" + }, + { + "calculationID": "Authentication_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The target involved in the authentication. You can alias this from more specific fields, such as dest_host, dest_ip, dest_mac, or dest_nt_host.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Authentication_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the user involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + } + ], + "constraints": [ + { + "search": "(`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$)" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication" + ] + }, + "objectName": "Failed_Authentication", + "displayName": "Failed Authentication", + "parentName": "Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"failure\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication" + ] + }, + "objectName": "Successful_Authentication", + "displayName": "Successful Authentication", + "parentName": "Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"success\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "default" + ] + }, + "objectName": "Default_Authentication", + "displayName": "Default Authentication", + "parentName": "Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=\"default\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "default" + ] + }, + "objectName": "Failed_Default_Authentication", + "displayName": "Failed Default Authentication", + "parentName": "Default_Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"failure\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "default" + ] + }, + "objectName": "Successful_Default_Authentication", + "displayName": "Successful Default Authentication", + "parentName": "Default_Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"success\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "insecure" + ] + }, + "objectName": "Insecure_Authentication", + "displayName": "Insecure Authentication", + "parentName": "Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=\"insecure\" OR tag=\"cleartext\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "privileged" + ] + }, + "objectName": "Privileged_Authentication", + "displayName": "Privileged Authentication", + "parentName": "Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=\"privileged\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "privileged" + ] + }, + "objectName": "Failed_Privileged_Authentication", + "displayName": "Failed Privileged Authentication", + "parentName": "Privileged_Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"failure\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "privileged" + ] + }, + "objectName": "Successful_Privileged_Authentication", + "displayName": "Successful Privileged Authentication", + "parentName": "Privileged_Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"success\"" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Certificates.json b/bin/datamodels/Certificates.json new file mode 100644 index 0000000000..9610f25358 --- /dev/null +++ b/bin/datamodels/Certificates.json @@ -0,0 +1,696 @@ +{ + "modelName": "Certificates", + "displayName": "Certificates", + "description": "Certificates Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "certificate" + ] + }, + "objectName": "All_Certificates", + "displayName": "All Certificates", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The target in the certificate management event." + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the target, such as email_server or SOX-compliant. This field is automatically provided by Asset and Identity correlation features of applications like the Splunk Enterprise Security.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The port number of the target." + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the target.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time for the completion of the certificate management event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took, in seconds, to receive a response in the certificate management event, if applicable." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source involved in the certificate management event. You can alias this from more specific fields, such as src_host, src_ip, or src_nt_host." + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the certificate management source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the certificate management source, such as email_server or SOX-compliant. This field is automatically provided by Asset and Identity correlation features of applications like the Splunk Enterprise Security.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The port number of the source." + }, + "fieldName": "src_port", + "displayName": "src_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the certificate management source.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The transport protocol of the Network Traffic involved with this certificate." + }, + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(`cim_Certificates_indexes`) tag=certificate" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "certificate", + "ssl" + ] + }, + "objectName": "SSL", + "displayName": "Transport Layer Security", + "parentName": "All_Certificates", + "fields": [ + { + "comment": { + "description": "The expiry time of the certificate.", + "recommended": true + }, + "fieldName": "ssl_end_time", + "displayName": "ssl_end_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the signature engine that created the certificate." + }, + "fieldName": "ssl_engine", + "displayName": "ssl_engine", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate issuer's email address." + }, + "fieldName": "ssl_issuer_email", + "displayName": "ssl_issuer_email", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate issuer's locality." + }, + "fieldName": "ssl_issuer_locality", + "displayName": "ssl_issuer_locality", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate issuer's state of residence." + }, + "fieldName": "ssl_issuer_state", + "displayName": "ssl_issuer_state", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate issuer's organization." + }, + "fieldName": "ssl_issuer_organization", + "displayName": "ssl_issuer_organization", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate issuer's organizational unit." + }, + "fieldName": "ssl_issuer_unit", + "displayName": "ssl_issuer_unit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate issuer's street address." + }, + "fieldName": "ssl_issuer_street", + "displayName": "ssl_issuer_street", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the ssl certificate." + }, + "fieldName": "ssl_name", + "displayName": "ssl_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The Object Identification Numbers of the certificate's policies in a comma separated string." + }, + "fieldName": "ssl_policies", + "displayName": "ssl_policies", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate's public key." + }, + "fieldName": "ssl_publickey", + "displayName": "ssl_publickey", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The algorithm used to create the public key." + }, + "fieldName": "ssl_publickey_algorithm", + "displayName": "ssl_publickey_algorithm", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate's serial number.", + "recommended": true + }, + "fieldName": "ssl_serial", + "displayName": "ssl_serial", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The session identifier for this certificate." + }, + "fieldName": "ssl_session_id", + "displayName": "ssl_session_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The algorithm used by the Certificate Authority to sign the certificate." + }, + "fieldName": "ssl_signature_algorithm", + "displayName": "ssl_signature_algorithm", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This is the start date and time for this certificate's validity.", + "recommended": true + }, + "fieldName": "ssl_start_time", + "displayName": "ssl_start_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate owner's e-mail address." + }, + "fieldName": "ssl_subject_email", + "displayName": "ssl_subject_email", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate owner's locality." + }, + "fieldName": "ssl_subject_locality", + "displayName": "ssl_subject_locality", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate owner's state of residence." + }, + "fieldName": "ssl_subject_state", + "displayName": "ssl_subject_state", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate owner's organization." + }, + "fieldName": "ssl_subject_organization", + "displayName": "ssl_subject_organization", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate owner's organizational unit." + }, + "fieldName": "ssl_subject_unit", + "displayName": "ssl_subject_unit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate owner's street address." + }, + "fieldName": "ssl_subject_street", + "displayName": "ssl_subject_street", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The ssl version of this certificate." + }, + "fieldName": "ssl_version", + "displayName": "ssl_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "SSL_fillnull_ssl_hash", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The hash of the certificate.", + "recommended": true + }, + "fieldName": "ssl_hash", + "displayName": "ssl_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(ssl_hash) OR ssl_hash=\"\",\"unknown\",ssl_hash)" + }, + { + "calculationID": "SSL_fillnull_ssl_issuer", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The certificate issuer's RFC2253 Distinguished Name.", + "recommended": true + }, + "fieldName": "ssl_issuer", + "displayName": "ssl_issuer", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(ssl_issuer) OR ssl_issuer=\"\",\"unknown\",ssl_issuer)" + }, + { + "calculationID": "SSL_fillnull_ssl_issuer_common_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The certificate issuer's common name.", + "recommended": true + }, + "fieldName": "ssl_issuer_common_name", + "displayName": "ssl_issuer_common_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(ssl_issuer_common_name) OR ssl_issuer_common_name=\"\",\"unknown\",ssl_issuer_common_name)" + }, + { + "calculationID": "SSL_ssl_issuer_email_domain", + "calculationType": "Rex", + "inputField": "ssl_issuer_email", + "outputFields": [ + { + "comment": { + "description": "The domain name contained within the certificate issuer's email address.", + "recommended": true + }, + "fieldName": "ssl_issuer_email_domain", + "displayName": "ssl_issuer_email_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "^.*@(?.+)$" + }, + { + "calculationID": "SSL_fillnull_ssl_subject", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The certificate owner's RFC2253 Distinguished Name.", + "recommended": true + }, + "fieldName": "ssl_subject", + "displayName": "ssl_subject", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(ssl_subject) OR ssl_subject=\"\",\"unknown\",ssl_subject)" + }, + { + "calculationID": "SSL_fillnull_ssl_subject_common_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The certificate subject's common name.", + "recommended": true + }, + "fieldName": "ssl_subject_common_name", + "displayName": "ssl_subject_common_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(ssl_subject_common_name) OR ssl_subject_common_name=\"\",\"unknown\",ssl_subject_common_name)" + }, + { + "calculationID": "SSL_ssl_subject_email_domain", + "calculationType": "Rex", + "inputField": "ssl_subject_email", + "outputFields": [ + { + "comment": { + "description": "The domain name contained within the certificate subject's email address.", + "recommended": true + }, + "fieldName": "ssl_subject_email_domain", + "displayName": "ssl_subject_email_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "^.*@(?.+)$" + }, + { + "calculationID": "SSL_0validity_window", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The length of time, in seconds, for which this certificate is valid.", + "ta_relevant": false + }, + "fieldName": "ssl_validity_window", + "displayName": "ssl_validity_window", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnum(ssl_end_time) AND isnum(ssl_start_time),ssl_end_time-ssl_start_time,null())" + }, + { + "calculationID": "SSL_1is_valid", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Indicator of whether the ssl certificate is valid or not.", + "expected_values": [ + "true", + "false", + "1", + "0" + ], + "ta_relevant": false + }, + "fieldName": "ssl_is_valid", + "displayName": "ssl_is_valid", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(match(ssl_is_valid, \"^(1|[Tt]|[Tt][Rr][Uu][Ee])$\"),1,match(ssl_is_valid, \"^(0|[Ff]|[Ff][Aa][Ll][Ss][Ee])$\"),0,isnum(ssl_end_time) AND isnum(ssl_start_time) AND _time>=ssl_start_time AND _time<=ssl_end_time,1,isnum(ssl_end_time) AND isnum(ssl_start_time),0,1=1,null())" + } + ], + "constraints": [ + { + "search": "(tag=ssl OR tag=tls)" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Change.json b/bin/datamodels/Change.json new file mode 100644 index 0000000000..9237c59402 --- /dev/null +++ b/bin/datamodels/Change.json @@ -0,0 +1,1134 @@ +{ + "modelName": "Change", + "displayName": "Change", + "description": "Change Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "change" + ] + }, + "objectName": "All_Changes", + "displayName": "All Changes", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The user agent through which the request was made, such as Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) or aws-cli/2.0.0 Python/3.7.4 Darwin/18.7.0 botocore/2.0.0dev4." + }, + "fieldName": "user_agent", + "displayName": "user_agent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of the user involved in the event or who initiated the event, such as IAMUser, Admin, or System. For account management events, this should represent the type of the user changed by the request." + }, + "fieldName": "user_type", + "displayName": "user_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The account associated with the change." + }, + "fieldName": "vendor_account", + "displayName": "vendor_account", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The data center region where the change occurred, such as us-west-2." + }, + "fieldName": "vendor_region", + "displayName": "vendor_region", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Changes_fillnull_change_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The type of change, such as filesystem or AAA (authentication, authorization, and accounting).", + "expected_values": [ + "restart" + ], + "recommended": true + }, + "fieldName": "change_type", + "displayName": "change_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(change_type) OR change_type=\"\",\"unknown\",change_type)" + }, + { + "calculationID": "All_Changes_fillnull_command", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The command that initiated the change.", + "recommended": true + }, + "fieldName": "command", + "displayName": "command", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(command) OR command=\"\",\"unknown\",if(sourcetype==\"audittrail\",Operation.\" \".ObjectName,command))" + }, + { + "calculationID": "All_Changes_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The resource where change occurred. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "All_Changes_fillnull_dvc", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The device that reported the change, if applicable, such as a FIP or CIM server. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.", + "recommended": true + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)" + }, + { + "calculationID": "All_Changes_fillnull_object", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Name of the affected object on the resource, such as a router interface, user account, or server volume.", + "recommended": true + }, + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object) OR object=\"\",\"unknown\",object)" + }, + { + "calculationID": "All_Changes_fillnull_object_attrs", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The attributes that were updated on the updated resource object, if applicable.", + "recommended": true + }, + "fieldName": "object_attrs", + "displayName": "object_attrs", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(object_attrs) OR object_attrs=\"\",\"unknown\",object_attrs)" + }, + { + "calculationID": "All_Changes_fillnull_object_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Generic name for the class of the updated resource object. Expected values may be specific to an app.", + "expected_values": [ + "directory", + "file", + "group", + "registry", + "user" + ], + "recommended": true + }, + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)" + }, + { + "calculationID": "All_Changes_fillnull_object_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The unique updated resource object ID as presented to the system, if applicable. For example, a SID, UUID, or GUID value.", + "recommended": true + }, + "fieldName": "object_id", + "displayName": "object_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_id) OR object_id=\"\",\"unknown\",object_id)" + }, + { + "calculationID": "All_Changes_fillnull_object_path", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The path of the modified resource object, if applicable, such as a file, directory, or volume.", + "recommended": true + }, + "fieldName": "object_path", + "displayName": "object_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_path) OR object_path=\"\",\"unknown\",object_path)" + }, + { + "calculationID": "All_Changes_fillnull_status", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Status of the update.", + "expected_values": [ + "success", + "failure" + ], + "recommended": true + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(status) OR status=\"\",\"unknown\",status)" + }, + { + "calculationID": "All_Changes_fillnull_result", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor-specific result of a change, or clarification of an action status. For example, status=failure may be accompanied by result=blocked by policy or result=disk full. Note: result is a string. Use msg_severity_id for severity ID fields that are integer data types.", + "expected_values": [ + "lockout" + ], + "recommended": true + }, + "fieldName": "result", + "displayName": "result", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(result) AND result!=\"\",result,if(isnotnull(signature) AND signature!=\"\",signature,\"unknown\"))" + }, + { + "calculationID": "All_Changes_fillnull_result_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "A result indicator for an action status.", + "recommended": true + }, + "fieldName": "result_id", + "displayName": "result_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(result_id) AND result_id!=\"\",result_id,if(isnotnull(signature_id) AND signature_id!=\"\",signature_id,-1))" + }, + { + "calculationID": "All_Changes_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The resource where the change was originated. You can alias this from more specific fields, such as src_host, src_ip, or src_name.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "All_Changes_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user or entity performing the change. For account changes, this is the account that was changed (see src_user for user or entity performing the change).", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "All_Changes_fillnull_user_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user name of the user or entity performing the change. For account changes, this is the account that was changed (see src_user_name for user or entity performing the change).", + "recommended": true + }, + "fieldName": "user_name", + "displayName": "user_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user_name) OR user_name=\"\",\"unknown\",user_name)" + }, + { + "calculationID": "All_Changes_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product or service that detected the change. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + }, + { + "calculationID": "All_Changes_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action attempted on the resource, regardless of success or failure.", + "expected_values": [ + "acl_modified", + "cleared", + "created", + "deleted", + "modified", + "stopped", + "lockout", + "read", + "logoff", + "updated", + "started", + "restarted", + "unlocked" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + } + ], + "constraints": [ + { + "search": "(`cim_Change_indexes`) tag=change NOT (object_category=file OR object_category=directory OR object_category=registry)" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "audit" + ] + }, + "objectName": "Auditing_Changes", + "displayName": "Auditing Changes", + "parentName": "All_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=audit" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Endpoint_Changes", + "displayName": "Endpoint Changes", + "parentName": "All_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=endpoint" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Endpoint_Restarts", + "displayName": "Endpoint Restarts", + "parentName": "Endpoint_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=modified change_type=restart" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Other_Endpoint_Changes", + "displayName": "Other Endpoint Changes", + "parentName": "Endpoint_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "NOT change_type=restart" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "network" + ] + }, + "objectName": "Network_Changes", + "displayName": "Network Changes", + "parentName": "All_Changes", + "fields": [ + { + "comment": { + "description": "For network events, the outgoing traffic for a specific destination IP address range. Specify a single IP address, or an IP address range in CIDR notation (for example, 203.0.113.5/32)", + "ta_relevant": false + }, + "fieldName": "dest_ip_range", + "displayName": "dest_ip_range", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "For network events, this field represents destination port or range. For example, 80 or 8000 - 8080 or 80,443", + "ta_relevant": false + }, + "fieldName": "dest_port_range", + "displayName": "dest_port_range", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "For network events, this field represents whether the traffic is inbound or outbound.", + "ta_relevant": false + }, + "fieldName": "direction", + "displayName": "direction", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field represents the protocol for the network event rule.", + "ta_relevant": false + }, + "fieldName": "protocol", + "displayName": "protocol", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "For network events, this field represents whether to allow or deny traffic.", + "ta_relevant": false + }, + "fieldName": "rule_action", + "displayName": "rule_action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "For network events, this field represents the incoming traffic from a specific source IP address or range. Specify a single IP address, or an IP address range in CIDR notation (for example, 203.0.113.5/32)", + "ta_relevant": false + }, + "fieldName": "src_ip_range", + "displayName": "src_ip_range", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "For network events, this field represents source port or range. For example, 80 or 8000 - 8080 or 80,443", + "ta_relevant": false + }, + "fieldName": "src_port_range", + "displayName": "src_port_range", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=network" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "network" + ] + }, + "objectName": "Device_Restarts", + "displayName": "Device Restarts", + "parentName": "Network_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=modified change_type=restart" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Account_Management", + "displayName": "Account Management", + "parentName": "All_Changes", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_bunit", + "displayName": "src_user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_category", + "displayName": "src_user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_priority", + "displayName": "src_user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "For account management events, this should represent the type of the user changed by the request." + }, + "fieldName": "src_user_type", + "displayName": "src_user_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Account_Management_fillnull_dest_nt_domain", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NT domain of the destination, if applicable.", + "recommended": true + }, + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest_nt_domain) OR dest_nt_domain=\"\",\"unknown\",dest_nt_domain)" + }, + { + "calculationID": "Account_Management_fillnull_src_nt_domain", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NT domain of the source, if applicable.", + "recommended": true + }, + "fieldName": "src_nt_domain", + "displayName": "src_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_nt_domain) OR src_nt_domain=\"\",\"unknown\",src_nt_domain)" + }, + { + "calculationID": "Account_Management_fillnull_src_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "For account changes, the user or entity performing the change.", + "recommended": true + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_user) OR src_user=\"\",\"unknown\",src_user)" + }, + { + "calculationID": "Account_Management_fillnull_src_user_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "For account changes, the user name of the user or entity performing the change.", + "recommended": true + }, + "fieldName": "src_user_name", + "displayName": "src_user_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_user_name) OR src_user_name=\"\",\"unknown\",src_user_name)" + } + ], + "constraints": [ + { + "search": "tag=account" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Accounts_Created", + "displayName": "Created Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"created\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Accounts_Deleted", + "displayName": "Deleted Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"deleted\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Account_Lockouts", + "displayName": "Locked Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "result=\"lockout\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Accounts_Updated", + "displayName": "Updated Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"updated\" OR action=\"modified\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "instance" + ] + }, + "objectName": "Instance_Changes", + "displayName": "Instance Changes", + "parentName": "All_Changes", + "fields": [], + "calculations": [ + { + "calculationID": "Instance_fillnull_image_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "For create instance events, this field represents the image ID used for creating the instance such as the OS, applications, installed libraries, and more.", + "recommended": true + }, + "fieldName": "image_id", + "displayName": "image_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(image_id) OR image_id=\"\",\"unknown\",image_id)" + }, + { + "calculationID": "Instance_fillnull_instance_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "For create instance events, this field represents the type of instance to build such as the combination of CPU, memory, storage, and network capacity.", + "recommended": true + }, + "fieldName": "instance_type", + "displayName": "instance_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(instance_type) OR instance_type=\"\",\"unknown\",instance_type)" + } + ], + "constraints": [ + { + "search": "tag=instance" + } + ], + "children": [] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Change_Analysis.json b/bin/datamodels/Change_Analysis.json new file mode 100644 index 0000000000..8d8a44c3f2 --- /dev/null +++ b/bin/datamodels/Change_Analysis.json @@ -0,0 +1,1088 @@ +{ + "modelName": "Change_Analysis", + "displayName": "Change Analysis (Deprecated)", + "description": "This model has been deprecated.", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "change" + ] + }, + "objectName": "All_Changes", + "displayName": "All Changes", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Changes_fillnull_change_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The type of change, such as filesystem or AAA (authentication, authorization, and accounting).", + "expected_values": [ + "restart" + ], + "recommended": true + }, + "fieldName": "change_type", + "displayName": "change_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(change_type) OR change_type=\"\",\"unknown\",change_type)" + }, + { + "calculationID": "All_Changes_fillnull_command", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The command that initiated the change.", + "recommended": true + }, + "fieldName": "command", + "displayName": "command", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(command) OR command=\"\",\"unknown\",if(sourcetype==\"audittrail\",Operation.\" \".ObjectName,command))" + }, + { + "calculationID": "All_Changes_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The resource where change occurred. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "All_Changes_fillnull_dvc", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The device that reported the change, if applicable, such as a FIP or CIM server. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.", + "recommended": true + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)" + }, + { + "calculationID": "All_Changes_fillnull_object", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Name of the affected object on the resource, such as a router interface, user account, or server volume.", + "recommended": true + }, + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object) OR object=\"\",\"unknown\",object)" + }, + { + "calculationID": "All_Changes_fillnull_object_attrs", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The attributes that were updated on the updated resource object, if applicable.", + "recommended": true + }, + "fieldName": "object_attrs", + "displayName": "object_attrs", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(object_attrs) OR object_attrs=\"\",\"unknown\",object_attrs)" + }, + { + "calculationID": "All_Changes_fillnull_object_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Generic name for the class of the updated resource object. Expected values may be specific to an app.", + "expected_values": [ + "directory", + "file", + "group", + "registry", + "user" + ], + "recommended": true + }, + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)" + }, + { + "calculationID": "All_Changes_fillnull_object_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The unique updated resource object ID as presented to the system, if applicable. For example, a SID, UUID, or GUID value.", + "recommended": true + }, + "fieldName": "object_id", + "displayName": "object_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_id) OR object_id=\"\",\"unknown\",object_id)" + }, + { + "calculationID": "All_Changes_fillnull_object_path", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The path of the modified resource object, if applicable, such as a file, directory, or volume.", + "recommended": true + }, + "fieldName": "object_path", + "displayName": "object_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_path) OR object_path=\"\",\"unknown\",object_path)" + }, + { + "calculationID": "All_Changes_fillnull_status", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Status of the update.", + "expected_values": [ + "success", + "failure" + ], + "recommended": true + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(status) OR status=\"\",\"unknown\",status)" + }, + { + "calculationID": "All_Changes_fillnull_result", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor-specific result of a change, or clarification of an action status. For example, status=failure may be accompanied by result=blocked by policy or result=disk full. Note: result is a string. Use msg_severity_id for severity ID fields that are integer data types.", + "expected_values": [ + "lockout" + ], + "recommended": true + }, + "fieldName": "result", + "displayName": "result", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(result) AND result!=\"\",result,if(isnotnull(signature) AND signature!=\"\",signature,\"unknown\"))" + }, + { + "calculationID": "All_Changes_fillnull_result_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "A result indicator for an action status.", + "recommended": true + }, + "fieldName": "result_id", + "displayName": "result_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(result_id) AND result_id!=\"\",result_id,if(isnotnull(signature_id) AND signature_id!=\"\",signature_id,-1))" + }, + { + "calculationID": "All_Changes_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The resource where the change was originated. You can alias this from more specific fields, such as src_host, src_ip, or src_name.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "All_Changes_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user or entity performing the change. For account changes, this is the account that was changed (see src_user for user or entity performing the change).", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "All_Changes_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product or service that detected the change. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + }, + { + "calculationID": "All_Changes_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action performed on the resource.", + "expected_values": [ + "acl_modified", + "cleared", + "created", + "deleted", + "modified", + "read", + "stopped", + "updated" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + } + ], + "constraints": [ + { + "search": "(`cim_Change_Analysis_indexes`) tag=change" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "audit" + ] + }, + "objectName": "Auditing_Changes", + "displayName": "Auditing Changes", + "parentName": "All_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=audit" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Endpoint_Changes", + "displayName": "Endpoint Changes", + "parentName": "All_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=endpoint" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Filesystem_Changes", + "displayName": "Filesystem Changes", + "parentName": "Endpoint_Changes", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Filesystem_Changes_eval_file_access_time", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The time the file (the object of the event) was accessed.", + "recommended": true + }, + "fieldName": "file_access_time", + "displayName": "file_access_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_access_time) OR file_access_time=\"\",0,file_access_time)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_create_time", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The time the file (the object of the event) was created.", + "recommended": true + }, + "fieldName": "file_create_time", + "displayName": "file_create_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_create_time) OR file_create_time=\"\",0,file_create_time)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_hash", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "A cryptographic identifier assigned to the file object affected by the event.", + "recommended": true + }, + "fieldName": "file_hash", + "displayName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_hash) OR file_hash=\"\",\"unknown\",file_hash)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_modify_time", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The time the file (the object of the event) was altered.", + "recommended": true + }, + "fieldName": "file_modify_time", + "displayName": "file_modify_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_modify_time) OR file_modify_time=\"\",0,file_modify_time)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the file that is the object of the event (without location information related to local file or directory structure).", + "recommended": true + }, + "fieldName": "file_name", + "displayName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_name) OR file_name=\"\",\"unknown\",file_name)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_path", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The location of the file that is the object of the event, in local file and directory structure terms.", + "recommended": true + }, + "fieldName": "file_path", + "displayName": "file_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_path) OR file_path=\"\",\"unknown\",file_path)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_acl", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Access controls associated with the file affected by the event.", + "recommended": true + }, + "fieldName": "file_acl", + "displayName": "file_acl", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_acl) OR file_acl=\"\",\"unknown\",file_acl)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_size", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The size of the file that is the object of the event, in kilobytes.", + "recommended": true + }, + "fieldName": "file_size", + "displayName": "file_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnum(file_size),file_size,null())" + } + ], + "constraints": [ + { + "search": "(object_category=file OR object_category=directory)" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Registry_Changes", + "displayName": "Registry Changes", + "parentName": "Endpoint_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "object_category=registry" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Endpoint_Restarts", + "displayName": "Endpoint Restarts", + "parentName": "Endpoint_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=modified change_type=restart" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Other_Endpoint_Changes", + "displayName": "Other Endpoint Changes", + "parentName": "Endpoint_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "NOT (object_category=file OR object_category=directory OR object_category=registry OR change_type=restart)" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "network" + ] + }, + "objectName": "Network_Changes", + "displayName": "Network Changes", + "parentName": "All_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=network" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "network" + ] + }, + "objectName": "Device_Restarts", + "displayName": "Device Restarts", + "parentName": "Network_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=modified change_type=restart" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Account_Management", + "displayName": "Account Management", + "parentName": "All_Changes", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_bunit", + "displayName": "src_user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_category", + "displayName": "src_user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_priority", + "displayName": "src_user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Account_Management_fillnull_dest_nt_domain", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NT domain of the destination, if applicable.", + "recommended": true + }, + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest_nt_domain) OR dest_nt_domain=\"\",\"unknown\",dest_nt_domain)" + }, + { + "calculationID": "Account_Management_fillnull_src_nt_domain", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NT domain of the source, if applicable.", + "recommended": true + }, + "fieldName": "src_nt_domain", + "displayName": "src_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_nt_domain) OR src_nt_domain=\"\",\"unknown\",src_nt_domain)" + }, + { + "calculationID": "Account_Management_fillnull_src_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "For account changes, the user or entity performing the change.", + "recommended": true + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_user) OR src_user=\"\",\"unknown\",src_user)" + } + ], + "constraints": [ + { + "search": "tag=account" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Accounts_Created", + "displayName": "Created Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"created\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Accounts_Deleted", + "displayName": "Deleted Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"deleted\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Account_Lockouts", + "displayName": "Locked Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "result=\"lockout\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Accounts_Updated", + "displayName": "Updated Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"updated\" OR action=\"modified\"" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Compute_Inventory.json b/bin/datamodels/Compute_Inventory.json new file mode 100644 index 0000000000..c9809cbf50 --- /dev/null +++ b/bin/datamodels/Compute_Inventory.json @@ -0,0 +1,1039 @@ +{ + "modelName": "Compute_Inventory", + "displayName": "Inventory", + "description": "Inventory Data Model", + "editable": false, + "objects": [ + { + "comment": { + "ta_relevant": false + }, + "objectName": "All_Inventory", + "displayName": "All Inventory", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The description of the inventory system." + }, + "fieldName": "description", + "displayName": "description", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the system where the data originated. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the system where the data originated, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the system where the data originated.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Indicates whether the resource is enabled or disabled." + }, + "fieldName": "enabled", + "displayName": "enabled", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The product family of the resource, such as 686_64 or RISC." + }, + "fieldName": "family", + "displayName": "family", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The hypervisor identifier, if applicable." + }, + "fieldName": "hypervisor_id", + "displayName": "hypervisor_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The serial number of the resource." + }, + "fieldName": "serial", + "displayName": "serial", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The current reported state of the resource." + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The version of a computer resource, such as 2008r2 or 3.0.0." + }, + "fieldName": "version", + "displayName": "version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Inventory_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system where the data originated, the source of the event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "All_Inventory_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the resource, such as Cisco Catalyst 3850. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Compute_Inventory_indexes`) tag=inventory (tag=cpu OR tag=memory OR tag=network OR tag=storage OR (tag=system tag=version) OR tag=user OR tag=virtual)" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "cpu" + ] + }, + "objectName": "CPU", + "displayName": "CPU", + "parentName": "All_Inventory", + "fields": [ + { + "comment": { + "description": "The number of CPU cores reported by the resource (total, not per CPU).", + "recommended": true + }, + "fieldName": "cpu_cores", + "displayName": "cpu_cores", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of CPUs reported by the resource.", + "recommended": true + }, + "fieldName": "cpu_count", + "displayName": "cpu_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum speed of the CPU reported by the resource (in megahertz).", + "recommended": true + }, + "fieldName": "cpu_mhz", + "displayName": "cpu_mhz", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=cpu" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "memory" + ] + }, + "objectName": "Memory", + "displayName": "Memory", + "parentName": "All_Inventory", + "fields": [ + { + "comment": { + "description": "The total amount of memory installed in or allocated to the resource, in megabytes.", + "recommended": true + }, + "fieldName": "mem", + "displayName": "mem", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=memory" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "network" + ] + }, + "objectName": "Network", + "displayName": "Network", + "parentName": "All_Inventory", + "fields": [ + { + "comment": { + "description": "The domain name server for the resource.", + "recommended": true + }, + "fieldName": "dns", + "displayName": "dns", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The network interfaces of the computing resource, such as eth0, eth1 or Wired Ethernet Connection, Teredo Tunneling Pseudo-Interface.", + "recommended": true + }, + "fieldName": "interface", + "displayName": "interface", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The network addresses of the computing resource, such as 192.168.1.1 or E80:0000:0000:0000:0202:B3FF:FE1E:8329.", + "recommended": true + }, + "fieldName": "ip", + "displayName": "ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The IP address for the system that the data is going to." + }, + "fieldName": "dest_ip", + "displayName": "dest_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The IP address for the system from which the data originates." + }, + "fieldName": "src_ip", + "displayName": "src_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A MAC (media access control) address associated with the resource, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field and use colons instead of dashes, spaces, or no separator.", + "recommended": true + }, + "fieldName": "mac", + "displayName": "mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The load balancing method used by the computing resource such as method, round robin, or least weight." + }, + "fieldName": "lb_method", + "displayName": "lb_method", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Represents a node hit." + }, + "fieldName": "node", + "displayName": "node", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Identifies whether the resource is a network address translation pool." + }, + "fieldName": "inline_nat", + "displayName": "inline_nat", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The port number for the virtual IP address (VIP). A VIP allows multiple MACs to use one IP address. VIPs are often used by load balancers." + }, + "fieldName": "vip_port", + "displayName": "vip_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of the destination port on the server that you requested from." + }, + "fieldName": "node_port", + "displayName": "node_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A name field provided in some data sources.", + "recommended": true + }, + "fieldName": "name", + "displayName": "name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=network" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "storage" + ] + }, + "objectName": "Storage", + "displayName": "Storage", + "parentName": "All_Inventory", + "fields": [ + { + "comment": { + "description": "The array that the storage resource is a member of, if applicable." + }, + "fieldName": "array", + "displayName": "array", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The block size used by the storage resource, in kilobytes." + }, + "fieldName": "blocksize", + "displayName": "blocksize", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The index cluster that the resource is a member of, if applicable." + }, + "fieldName": "cluster", + "displayName": "cluster", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum number of file descriptors available." + }, + "fieldName": "fd_max", + "displayName": "fd_max", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The latency reported by the resource, in milliseconds." + }, + "fieldName": "latency", + "displayName": "latency", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The path at which a storage resource is mounted.", + "recommended": true + }, + "fieldName": "mount", + "displayName": "mount", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A higher level object that this resource is owned by, if applicable." + }, + "fieldName": "parent", + "displayName": "parent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum possible number of blocks read per second during a polling period." + }, + "fieldName": "read_blocks", + "displayName": "read_blocks", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "For a polling period, the average amount of time elapsed until a read request is filled by the host disks (in ms)." + }, + "fieldName": "read_latency", + "displayName": "read_latency", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of read operations in the polling period." + }, + "fieldName": "read_ops", + "displayName": "read_ops", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of storage capacity allocated to the resource, in megabytes.", + "recommended": true + }, + "fieldName": "storage", + "displayName": "storage", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum possible number of blocks written per second during a polling period." + }, + "fieldName": "write_blocks", + "displayName": "write_blocks", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "For a polling period, the average amount of time elapsed until a write request is filled by the host disks (in ms)." + }, + "fieldName": "write_latency", + "displayName": "write_latency", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of write operations in the polling period." + }, + "fieldName": "write_ops", + "displayName": "write_ops", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=storage" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "system", + "version" + ] + }, + "objectName": "OS", + "displayName": "OS", + "parentName": "All_Inventory", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "OS_os", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The operating system of the resource, such as Microsoft Windows Server 2008r2. This field is constructed from vendor_product and version fields.", + "recommended": true + }, + "fieldName": "os", + "displayName": "os", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(os) AND os!=\"\",replace(replace(os,\"(?:\\(R\\)|\\\\\\\\xA8)\",\"\"),\"^(?:MS)?\\s*Windows\",\"Microsoft Windows\"),\"unknown\")" + } + ], + "constraints": [ + { + "search": "tag=system tag=version" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "user" + ] + }, + "objectName": "User", + "displayName": "User", + "parentName": "All_Inventory", + "fields": [ + { + "comment": { + "description": "Indicates the shell program used by a locally defined account." + }, + "fieldName": "shell", + "displayName": "shell", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the locally-defined user account. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the system where the data originated, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The user identification for a locally defined account." + }, + "fieldName": "user_id", + "displayName": "user_id", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of a locally-defined account.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "User_interactive", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Indicates whether a locally defined account on a resource can be interactively logged in.", + "recommended": true + }, + "fieldName": "interactive", + "displayName": "interactive", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(interactive) AND interactive!=\"\",interactive,tag=\"interactive\",\"true\",1=1,\"false\")" + }, + { + "calculationID": "User_password", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Displays the stored password(s) for a locally defined account, if it has any. For instance, an add-on may report the password column from \/etc\/passwd in this field.", + "recommended": true + }, + "fieldName": "password", + "displayName": "password", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if((password==\"*\" OR password==\"x\" OR password==\"\"),null(),password)" + }, + { + "calculationID": "User_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The full name of a locally defined account.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + } + ], + "constraints": [ + { + "search": "tag=user" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "user" + ] + }, + "objectName": "Cleartext_Passwords", + "displayName": "Cleartext Passwords", + "parentName": "User", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "password=*" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "user", + "default" + ] + }, + "objectName": "Default_Accounts", + "displayName": "Default Accounts", + "parentName": "User", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=default" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "virtual" + ] + }, + "objectName": "Virtual_OS", + "displayName": "Virtual OS", + "parentName": "All_Inventory", + "fields": [ + { + "comment": { + "description": "The hypervisor parent of a virtual guest OS.", + "recommended": true + }, + "fieldName": "hypervisor", + "displayName": "hypervisor", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=virtual" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "virtual", + "snapshot" + ] + }, + "objectName": "Snapshot", + "displayName": "Snapshot", + "parentName": "Virtual_OS", + "fields": [ + { + "comment": { + "description": "The snapshot file size, in megabytes.", + "recommended": true + }, + "fieldName": "size", + "displayName": "size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of a snapshot file.", + "recommended": true + }, + "fieldName": "snapshot", + "displayName": "snapshot", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time at which the snapshot was taken." + }, + "fieldName": "time", + "displayName": "time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=snapshot" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "virtual", + "tools" + ] + }, + "objectName": "Tools", + "displayName": "Tools", + "parentName": "Virtual_OS", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=tools" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/DLP.json b/bin/datamodels/DLP.json new file mode 100644 index 0000000000..cd92294df1 --- /dev/null +++ b/bin/datamodels/DLP.json @@ -0,0 +1,591 @@ +{ + "modelName": "DLP", + "displayName": "Data Loss Prevention", + "description": "Data Loss Prevention Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "dlp", + "incident" + ] + }, + "objectName": "DLP_Incidents", + "displayName": "DLP Incidents", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The application involved in the event." + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The zone of the DLP target." + }, + "fieldName": "dest_zone", + "displayName": "dest_zone", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_bunit", + "displayName": "dvc_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_category", + "displayName": "dvc_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_priority", + "displayName": "dvc_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The zone of the DLP device." + }, + "fieldName": "dvc_zone", + "displayName": "dvc_zone", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The zone of the DLP source." + }, + "fieldName": "src_zone", + "displayName": "src_zone", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_bunit", + "displayName": "src_user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_category", + "displayName": "src_user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_priority", + "displayName": "src_user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "DLP_Incidents_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action taken by the DLP device.", + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "DLP_Incidents_fillnull_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The category of the DLP event.", + "recommended": true + }, + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)" + }, + { + "calculationID": "DLP_Incidents_fillnull_dvc", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The device that reported the DLP event.", + "recommended": true + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)" + }, + { + "calculationID": "DLP_incidents_fillnull_dlp_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The type of DLP system that generated the event.", + "recommended": true + }, + "fieldName": "dlp_type", + "displayName": "dlp_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dlp_type) OR dlp_type=\"\",\"unknown\",dlp_type)" + }, + { + "calculationID": "DLP_Incidents_fillnull_object", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the affected object.", + "recommended": true + }, + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object) OR object=\"\",\"unknown\",object)" + }, + { + "calculationID": "DLP_Incidents_fillnull_object_path", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The path of the affected object.", + "recommended": true + }, + "fieldName": "object_path", + "displayName": "object_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_path) OR object_path=\"\",\"unknown\",object_path)" + }, + { + "calculationID": "DLP_Incidents_fillnull_object_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The category of the affected object.", + "recommended": true + }, + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)" + }, + { + "calculationID": "DLP_Incidents_fillnull_signature", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the DLP event.", + "recommended": true + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)" + }, + { + "calculationID": "DLP_Incidents_fillnull_severity", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The severity of the DLP event.", + "recommended": true + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)" + }, + { + "calculationID": "DLP_Incidents_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source of the DLP event.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "DLP_Incidents_fillnull_src_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source user of the DLP event.", + "recommended": true + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_user) OR user=\"\",\"unknown\",src_user)" + }, + { + "calculationID": "DLP_Incidents_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The target of the DLP event.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "DLP_Incidents_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The target user of the DLP event.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "DLP_Incidents_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the DLP system.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_DLP_indexes`) tag=dlp tag=incident" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Data_Access.json b/bin/datamodels/Data_Access.json new file mode 100644 index 0000000000..455b6cb1b1 --- /dev/null +++ b/bin/datamodels/Data_Access.json @@ -0,0 +1,463 @@ +{ + "modelName": "Data_Access", + "displayName": "Data Access", + "description": "Data Access Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "data", + "access" + ] + }, + "objectName": "Data_Access", + "displayName": "Data Access", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "Application ID of the user" + }, + "fieldName": "application_id", + "displayName": "application_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Name of the destination as defined by the Vendor." + }, + "fieldName": "dest_name", + "displayName": "dest_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Url of the product, application or object." + }, + "fieldName": "dest_url", + "displayName": "dest_url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The device that reported the data access event." + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The email address of the user involved in the event, or who initiated the event." + }, + "fieldName": "email", + "displayName": "email", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The path of the modified resource object, if applicable, such as a file, directory, or volume." + }, + "fieldName": "object_path", + "displayName": "object_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Resource owner." + }, + "fieldName": "owner", + "displayName": "owner", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "ID of the owner as defined by the vendor." + }, + "fieldName": "owner_id", + "displayName": "owner_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Email of the resource owner." + }, + "fieldName": "owner_email", + "displayName": "owner_email", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Parent of the object name on which the action was performed by a user." + }, + "fieldName": "parent_object", + "displayName": "parent_object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Object category of the parent object on which action was performed by a user." + }, + "fieldName": "parent_object_category", + "displayName": "parent_object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Object id of the parent object on which the action was performed by a user." + }, + "fieldName": "parent_object_id", + "displayName": "parent_object_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The user agent through which the request was made, such as Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) or aws-cli/2.0.0 Python/3.7.4 Darwin/18.7.0 botocore/2.0.0dev4." + }, + "fieldName": "user_agent", + "displayName": "user_agent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The group of the user involved in the event, or who initiated the event." + }, + "fieldName": "user_group", + "displayName": "user_group", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The role of the user involved in the event, or who initiated the event." + }, + "fieldName": "user_role", + "displayName": "user_role", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The vendor and product name ID as defined by the vendor." + }, + "fieldName": "vendor_product_id", + "displayName": "vendor_product_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Data_Access_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The data access action taken by the user.", + "expected_values": [ + "copied", + "created", + "deleted", + "modified", + "read", + "stopped", + "updated", + "downloaded", + "uploaded", + "shared" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Data_Access_fillnull_app", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system, service, or application that generated the data access event. Examples include Onedrive, Sharepoint, drive, AzureActiveDirectory.", + "recommended": true + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(app) OR app=\"\",sourcetype,app)" + }, + { + "calculationID": "Data_Access_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination where the data resides or where it is being accessed, such as the product or application. You can alias this from more specific fields not included in this data model, such as dest_host, dest_ip, dest_url or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Data_Access_fillnull_object", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Resource object name on which the action was performed by a user.", + "recommended": true + }, + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object) OR object=\"\",\"unknown\",object)" + }, + { + "calculationID": "Data_Access_fillnull_object_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Generic name for the class of the updated resource object. Expected values may be specific to an app.", + "expected_values": [ + "collaboration", + "file", + "folder", + "comment", + "task", + "note" + ], + "recommended": true + }, + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)" + }, + { + "calculationID": "Data_Access_fillnull_object_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The unique updated resource object ID as presented to the system, if applicable. For example, a source_folder_id, doc_id.", + "recommended": true + }, + "fieldName": "object_id", + "displayName": "object_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_id) OR object_id=\"\",\"unknown\",object_id)" + }, + { + "calculationID": "Data_Access_fillnull_object_size", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The size of the modified resource object.", + "recommended": true + }, + "fieldName": "object_size", + "displayName": "object_size", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_size) OR object_size=\"\",\"unknown\",object_size)" + }, + { + "calculationID": "Data_Access_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint client host.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "Data_Access_fillnull_vendor_account", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The account that manages the user that initiated the request.", + "recommended": true + }, + "fieldName": "vendor_account", + "displayName": "vendor_account", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(vendor_account) OR vendor_account=\"\",\"unknown\",vendor_account)" + }, + { + "calculationID": "All_Changes_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user involved in the event, or who initiated the event.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Data_Access_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the vendor.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Data_Access_indexes`) tag=data tag=access" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Databases.json b/bin/datamodels/Databases.json new file mode 100644 index 0000000000..f2f17626dd --- /dev/null +++ b/bin/datamodels/Databases.json @@ -0,0 +1,1139 @@ +{ + "modelName": "Databases", + "displayName": "Databases", + "description": "Data Model for all databases", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "database" + ] + }, + "objectName": "All_Databases", + "displayName": "All Databases", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The destination of the database event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name." + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time for the completion of the database event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the database object." + }, + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response in the database event, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source of the database event. You can alias this from more specific fields, such as src_host, src_ip, or src_name." + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the source.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the source.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the source.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "Name of the database process user." + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the user.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category associated with the user.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Databases_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the database system. This field can be automatically populated by vendor and product fields in your data." + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Databases_indexes`) tag=database" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "instance" + ] + }, + "objectName": "Database_Instance", + "displayName": "Database Instance", + "parentName": "All_Databases", + "fields": [ + { + "comment": { + "description": "The name of the database instance." + }, + "fieldName": "instance_name", + "displayName": "instance_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The version of the database instance." + }, + "fieldName": "instance_version", + "displayName": "instance_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum number of sessions that the database instance can handle." + }, + "fieldName": "session_limit", + "displayName": "session_limit", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum number of processes that the database instance can handle." + }, + "fieldName": "process_limit", + "displayName": "process_limit", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=instance" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "instance", + "stats" + ] + }, + "objectName": "Instance_Stats", + "displayName": "Instance Stats", + "parentName": "Database_Instance", + "fields": [ + { + "comment": { + "description": "The total amount of uptime for the database instance." + }, + "fieldName": "start_time", + "displayName": "start_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status of the database server.", + "expected_values": [ + "Available", + "Not Available" + ] + }, + "fieldName": "availability", + "displayName": "availability", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of sessions currently in use for the database instance." + }, + "fieldName": "sessions", + "displayName": "sessions", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of processes currently running for the database instance." + }, + "fieldName": "processes", + "displayName": "processes", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of the database dump area that has been used." + }, + "fieldName": "dump_area_used", + "displayName": "dump_area_used", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total amount of tablespace used for the database instance, in bytes." + }, + "fieldName": "tablespace_used", + "displayName": "tablespace_used", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of users for the database instance." + }, + "fieldName": "number_of_users", + "displayName": "number_of_users", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The average number of executions for the database instance." + }, + "fieldName": "avg_executions", + "displayName": "avg_executions", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of reads for the database instance." + }, + "fieldName": "instance_reads", + "displayName": "instance_reads", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of writes for the database instance." + }, + "fieldName": "instance_writes", + "displayName": "instance_writes", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total size of the buffer cache for the database instance, in bytes." + }, + "fieldName": "sga_buffer_cache_size", + "displayName": "sga_buffer_cache_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total size of the shared pool for this database instance, in bytes." + }, + "fieldName": "sga_shared_pool_size", + "displayName": "sga_shared_pool_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total size of the redo log buffer for the database instance, in bytes." + }, + "fieldName": "sga_redo_log_buffer_size", + "displayName": "sga_redo_log_buffer_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total library cache size for the database instance, in bytes." + }, + "fieldName": "sga_library_cache_size", + "displayName": "sga_library_cache_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The size of the fixed area (also referred to as the fixed SGA) for the database instance, in bytes." + }, + "fieldName": "sga_fixed_area_size", + "displayName": "sga_fixed_area_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total size of the SQL area for this database instance, in bytes." + }, + "fieldName": "sga_sql_area_size", + "displayName": "sga_sql_area_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum number of buffers that can be hit in the database instance without finding a free buffer." + }, + "fieldName": "sga_buffer_hit_limit", + "displayName": "sga_buffer_hit_limit", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The hit-to-miss ratio for the database instance's data dictionary." + }, + "fieldName": "sga_data_dict_hit_ratio", + "displayName": "sga_data_dict_hit_ratio", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total amount of free memory in the database instance SGA, in bytes." + }, + "fieldName": "sga_free_memory", + "displayName": "sga_free_memory", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=stats" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "instance", + "session" + ] + }, + "objectName": "Session_Info", + "displayName": "Session Info", + "parentName": "Database_Instance", + "fields": [ + { + "comment": { + "description": "The unique id that identifies the session." + }, + "fieldName": "session_id", + "displayName": "session_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The current status of the session.", + "expected_values": [ + "Online", + "Offline" + ] + }, + "fieldName": "session_status", + "displayName": "session_status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the logical host associated with the database instance." + }, + "fieldName": "machine", + "displayName": "machine", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total amount of time elapsed since the user started the session by logging into the database server, in seconds." + }, + "fieldName": "elapsed_time", + "displayName": "elapsed_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of CPU centiseconds used by the session. Divide this value by 100 to get the CPU seconds." + }, + "fieldName": "cpu_used", + "displayName": "cpu_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of memory sorts performed during the session." + }, + "fieldName": "memory_sorts", + "displayName": "memory_sorts", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Number of table scans performed during the session." + }, + "fieldName": "table_scans", + "displayName": "table_scans", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of physical reads performed during the session." + }, + "fieldName": "physical_reads", + "displayName": "physical_reads", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of consistent gets and database block gets performed during the session." + }, + "fieldName": "logical_reads", + "displayName": "logical_reads", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of commits per second performed by the user associated with the session." + }, + "fieldName": "commits", + "displayName": "commits", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of the cursor currently in use by the session." + }, + "fieldName": "cursor", + "displayName": "cursor", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The percentage of logical reads from the buffer during the session (1-physical reads\/session logical reads*100)." + }, + "fieldName": "buffer_cache_hit_ratio", + "displayName": "buffer_cache_hit_ratio", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Provides the current wait state for the session. Can indicate that the session is currently waiting or provide information about the session's last wait. WAITING indicates the session is currently waiting, WAITED UNKNOWN TIME indicates the duration of the last session wait is unknown, WAITED SHORT TIME indicates the last session wait was < 1\/100th of a second, WAITED KNOWN TIME indicates the wait_time is the duration of the last session wait.", + "expected_values": [ + "WAITING", + "WAITED UNKNOWN", + "WAITED SHORT TIME", + "WAITED KNOWN TIME" + ] + }, + "fieldName": "wait_state", + "displayName": "wait_state", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "When wait_time = 0, the session is waiting. When wait_time has a nonzero value, it is displaying the last wait time for the session." + }, + "fieldName": "wait_time", + "displayName": "wait_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The seconds_in_wait depends on the value of wait_time. If wait_time = 0, seconds_in_wait is the number of seconds spent in the current wait condition. If wait_time has a nonzero value, seconds_in_wait is the number of seconds that have elapsed since the start of the last wait. You can get the active seconds that have elapsed since the last wait ended by calculating seconds_in_wait - wait_time \/ 100." + }, + "fieldName": "seconds_in_wait", + "displayName": "seconds_in_wait", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=session" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "instance", + "lock" + ] + }, + "objectName": "Lock_Info", + "displayName": "Lock Info", + "parentName": "Database_Instance", + "fields": [ + { + "comment": { + "description": "The name of the locked object." + }, + "fieldName": "obj_name", + "displayName": "obj_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The session identifier of the locked object." + }, + "fieldName": "lock_session_id", + "displayName": "lock_session_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The serial number of the object." + }, + "fieldName": "serial_num", + "displayName": "serial_num", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The mode of the lock on the object." + }, + "fieldName": "lock_mode", + "displayName": "lock_mode", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The process identifier for the operating system." + }, + "fieldName": "os_pid", + "displayName": "os_pid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Represents the amount of time elapsed since the session_status changed to its current status. The definition of this field depends on the session_status value. If session_status = ONLINE, the last_call_minute value represents the time elapsed since the session became active. If session_status = OFFLINE, the last_call_minute value represents the time elapsed since the session became inactive." + }, + "fieldName": "last_call_minute", + "displayName": "last_call_minute", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The database logon time for the session." + }, + "fieldName": "logon_time", + "displayName": "logon_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=lock" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "query" + ] + }, + "objectName": "Database_Query", + "displayName": "Database Query", + "parentName": "All_Databases", + "fields": [ + { + "comment": { + "description": "The full database query." + }, + "fieldName": "query", + "displayName": "query", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The identifier for the database query." + }, + "fieldName": "query_id", + "displayName": "query_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time the system initiated the database query." + }, + "fieldName": "query_time", + "displayName": "query_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of records affected by the database query." + }, + "fieldName": "records_affected", + "displayName": "records_affected", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=query" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "query", + "tablespace" + ] + }, + "objectName": "Tablespace", + "displayName": "Tablespace", + "parentName": "Database_Query", + "fields": [ + { + "comment": { + "description": "The name of the tablespace." + }, + "fieldName": "tablespace_name", + "displayName": "tablespace_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status of the tablespace.", + "expected_values": [ + "Offline", + "Online", + "Read Only" + ] + }, + "fieldName": "tablespace_status", + "displayName": "tablespace_status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total amount of free space in the tablespace, in bytes." + }, + "fieldName": "free_bytes", + "displayName": "free_bytes", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of tablespace reads carried out by the query." + }, + "fieldName": "tablespace_reads", + "displayName": "tablespace_reads", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of tablespace writes carried out by the query." + }, + "fieldName": "tablespace_writes", + "displayName": "tablespace_writes", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=tablespace" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "query", + "stats" + ] + }, + "objectName": "Query_Stats", + "displayName": "Query Stats", + "parentName": "Database_Query", + "fields": [ + { + "comment": { + "description": "The names of the stored procedures called by the query." + }, + "fieldName": "stored_procedures_called", + "displayName": "stored_procedures_called", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The names of the tables hit by the query." + }, + "fieldName": "tables_hit", + "displayName": "tables_hit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The names of the indexes hit by the database query." + }, + "fieldName": "indexes_hit", + "displayName": "indexes_hit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the query plan hit by the query." + }, + "fieldName": "query_plan_hit", + "displayName": "query_plan_hit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=stats" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Email.json b/bin/datamodels/Email.json new file mode 100644 index 0000000000..8997f5353b --- /dev/null +++ b/bin/datamodels/Email.json @@ -0,0 +1,825 @@ +{ + "modelName": "Email", + "displayName": "Email", + "description": "Email Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "email" + ] + }, + "objectName": "All_Email", + "displayName": "All Email", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "Total sending delay in milliseconds." + }, + "displayName": "delay", + "fieldName": "delay", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the endpoint system to which the message was delivered. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the endpoint system to which the message was delivered. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the endpoint system to which the message was delivered. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time for the completion of the messaging event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The hashes for the files attached to the message, if any exist." + }, + "displayName": "file_hash", + "fieldName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The names of the files attached to the message, if any exist." + }, + "displayName": "file_name", + "fieldName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The size of the files attached the message, in bytes." + }, + "displayName": "file_size", + "fieldName": "file_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Host-specific unique message identifier (such as aid in sendmail, IMI in Domino, Internal-Message-ID in Exchange, and MID in Ironport)." + }, + "displayName": "internal_message_id", + "fieldName": "internal_message_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The globally-unique message identifier." + }, + "displayName": "message_id", + "fieldName": "message_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Additional information about the message." + }, + "displayName": "message_info", + "fieldName": "message_info", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The original destination host of the message. The message destination host can change when a message is relayed or bounced." + }, + "displayName": "orig_dest", + "fieldName": "orig_dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The original recipient of the message. The message recipient can change when the original email address is an alias and has to be resolved to the actual recipient." + }, + "displayName": "orig_recipient", + "fieldName": "orig_recipient", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The original source of the message." + }, + "displayName": "orig_src", + "fieldName": "orig_src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The email protocol involved, such as SMTP or RPC.", + "expected_values": [ + "smtp", + "imap", + "pop3", + "mapi" + ] + }, + "displayName": "protocol", + "fieldName": "protocol", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the email executable that carries out the message transaction, such as sendmail, postfix, or the name of an email client." + }, + "fieldName": "process", + "displayName": "process", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process invoked to send the message." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The recipient delivery status, if available." + }, + "displayName": "recipient_status", + "fieldName": "recipient_status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response in the messaging event, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of times that the message was automatically resent because it was bounced back, or a similar transmission error condition." + }, + "displayName": "retries", + "fieldName": "retries", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The return address for the message." + }, + "displayName": "return_addr", + "fieldName": "return_addr", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The size of the message, in bytes." + }, + "displayName": "size", + "fieldName": "size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the system that sent the message. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the system that sent the message. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the system that sent the message. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the message sender. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_bunit", + "displayName": "src_user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the message sender. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_category", + "displayName": "src_user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the message sender. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_priority", + "displayName": "src_user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status code associated with the message." + }, + "displayName": "status_code", + "fieldName": "status_code", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The subject of the message." + }, + "displayName": "subject", + "fieldName": "subject", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The URL associated with the message, if any." + }, + "displayName": "url", + "fieldName": "url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The user context for the process. This is not the email address for the sender. For that, use the src_user field." + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the user context for the process. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the user context for the process. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user context for the process. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Extended delay information for the message transaction. May contain details of all the delays from all the servers in the message transmission chain." + }, + "displayName": "xdelay", + "fieldName": "xdelay", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "An external reference. Can contain message IDs or recipient addresses from related messages." + }, + "displayName": "xref", + "fieldName": "xref", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Email_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Action taken by the reporting device.", + "expected_values": [ + "delivered", + "blocked", + "quarantined", + "deleted" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Email_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint system to which the message was delivered. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Email_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system that sent the message. You can alias this from more specific fields, such as src_host, src_ip, or src_name.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "0Email_fillnull_recipient", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The recipient email addresses.", + "recommended": true + }, + "fieldName": "recipient", + "displayName": "recipient", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(recipient) OR recipient=\"\",\"unknown\",recipient)" + }, + { + "calculationID": "1Email_recipient_domain", + "calculationType": "Rex", + "inputField": "recipient", + "outputFields": [ + { + "comment": { + "description": "The domain name contained within the recipient email addresses.", + "recommended": true + }, + "fieldName": "recipient_domain", + "displayName": "recipient_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "^.*@(?.+)$" + }, + { + "calculationID": "2Email_recipient_count", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The total number of intended message recipients.", + "ta_relevant": false + }, + "fieldName": "recipient_count", + "displayName": "recipient_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(recipient_count),recipient_count,isnotnull(recipient),mvcount(recipient),1=1,1)" + }, + { + "calculationID": "0Email_fillnull_src_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The email address of the message sender.", + "recommended": true + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_user) OR src_user=\"\",\"unknown\",src_user)" + }, + { + "calculationID": "1Email_src_user_domain", + "calculationType": "Rex", + "inputField": "src_user", + "outputFields": [ + { + "comment": { + "description": "The domain name contained within the email address of the message sender.", + "recommended": true + }, + "fieldName": "src_user_domain", + "displayName": "src_user_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "^.*@(?.+)$" + }, + { + "calculationID": "Email_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product of the email server used for the email transaction. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Email_indexes`) tag=email" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "email", + "delivery" + ] + }, + "objectName": "Delivery", + "displayName": "Email Delivery", + "parentName": "All_Email", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=delivery" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "email", + "content" + ] + }, + "objectName": "Content", + "displayName": "Email Content", + "parentName": "All_Email", + "fields": [ + + ], + "constraints": [ + { + "search": "tag=content" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "email", + "filter" + ] + }, + "objectName": "Filtering", + "displayName": "Email Filtering", + "parentName": "All_Email", + "fields": [ + { + "comment": { + "description": "The status produced by the filter, such as 'accepted', 'rejected', or 'dropped'." + }, + "displayName": "filter_action", + "fieldName": "filter_action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Numeric indicator assigned to specific emails by an email filter." + }, + "displayName": "filter_score", + "fieldName": "filter_score", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the filter applied.", + "recommended": true + }, + "displayName": "signature", + "fieldName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Any additional information about the filter." + }, + "displayName": "signature_extra", + "fieldName": "signature_extra", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The id associated with the filter name." + }, + "displayName": "signature_id", + "fieldName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=filter" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Endpoint.json b/bin/datamodels/Endpoint.json new file mode 100644 index 0000000000..79226305b8 --- /dev/null +++ b/bin/datamodels/Endpoint.json @@ -0,0 +1,2269 @@ +{ + "modelName": "Endpoint", + "displayName": "Endpoint", + "description": "Endpoint Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "listening", + "port" + ] + }, + "objectName": "Ports", + "displayName": "Ports", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The time at which the network port started listening on the endpoint." + }, + "fieldName": "creation_time", + "displayName": "creation_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "Network port listening on the endpoint, such as 53.", + "recommended": true + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The globally unique identifier of the process assigned by the vendor_product." + }, + "fieldName": "process_guid", + "displayName": "process_guid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process assigned by the operating system." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_requires_av", + "displayName": "src_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_should_timesync", + "displayName": "src_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_should_update", + "displayName": "src_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status of the listening port, such as established, listening, etc." + }, + "fieldName": "state", + "displayName": "state", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The network transport protocol associated with the listening port, such as tcp, udp, etc.", + "recommended": true + }, + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Calculated as transport\/dest_port, such as tcp\/53.", + "ta_relevant": false + }, + "fieldName": "transport_dest_port", + "displayName": "transport_dest_port", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Endpoint_Ports_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The \"remote\" system connected to the listening port (if applicable).", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "Endpoint_Ports_fillnull_src_port", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The \"remote\" port connected to the listening port (if applicable).", + "recommended": true + }, + "fieldName": "src_port", + "displayName": "src_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnum(src_port),src_port,0)" + }, + { + "calculationID": "Endpoint_Ports_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint for which the port is listening on.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Endpoint_Ports_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user account associated with the listening port.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Endpoint_Ports_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the Endpoint solution that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Endpoint_indexes`) tag=listening tag=port | eval transport=if(isnull(transport) OR transport=\"\",\"unknown\",transport),dest_port=if(isnull(dest_port) OR dest_port=\"\",0,dest_port),transport_dest_port=mvzip(transport,dest_port,\"\/\") | mvexpand transport_dest_port", + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "process", + "report" + ] + }, + "objectName": "Processes", + "displayName": "Processes", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The action taken by the endpoint." + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "CPU load consumed by the process (in percent)." + }, + "fieldName": "cpu_load_percent", + "displayName": "cpu_load_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_is_expected", + "displayName": "dest_is_expected", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Memory used by the process (in bytes)." + }, + "fieldName": "mem_used", + "displayName": "mem_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The operating system of the resource, such as Microsoft Windows Server 2008r2." + }, + "fieldName": "os", + "displayName": "os", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The executable name of the parent process." + }, + "fieldName": "parent_process_exec", + "displayName": "parent_process_exec", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the parent process assigned by the operating system." + }, + "fieldName": "parent_process_id", + "displayName": "parent_process_id", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The globally unique identifier of the parent process assigned by the vendor_product." + }, + "fieldName": "parent_process_guid", + "displayName": "parent_process_guid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The file path of the parent process, such as C:\\Windows\\System32\\notepad.exe." + }, + "fieldName": "parent_process_path", + "displayName": "parent_process_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The current working directory used to spawn the process." + }, + "fieldName": "process_current_directory", + "displayName": "process_current_directory", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The executable name of the process." + }, + "fieldName": "process_exec", + "displayName": "process_exec", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The digest(s) of the parent process, such as , , etc." + }, + "fieldName": "process_hash", + "displayName": "process_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The globally unique identifier of the process assigned by the vendor_product." + }, + "fieldName": "process_guid", + "displayName": "process_guid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process assigned by the operating system." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The integrity level of the process.", + "expected_values": [ + "system", + "high", + "medium", + "low", + "untrusted" + ] + }, + "fieldName": "process_integrity_level", + "displayName": "process_integrity_level", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The file path of the process, such as C:\\Windows\\System32\\notepad.exe." + }, + "fieldName": "process_path", + "displayName": "process_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier of the user account which spawned the process." + }, + "fieldName": "user_id", + "displayName": "user_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Endpoint_Processes_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint for which the process was spawned.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Endpoint_Processes_fillnull_original_file_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Original name of the file not including path.", + "recommended": true + }, + "fieldName": "original_file_name", + "displayName": "original_file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(original_file_name) OR original_file_name=\"\",\"unknown\",original_file_name)" + }, + { + "calculationID": "Endpoint_Processes_fillnull_parent_process", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The full command string of the parent process", + "recommended": true + }, + "fieldName": "parent_process", + "displayName": "parent_process", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(parent_process) OR parent_process=\"\",\"unknown\",parent_process)" + }, + { + "calculationID": "Endpoint_Processes_fillnull_parent_process_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The friendly name of the parent process, such as notepad.exe.", + "recommended": true + }, + "fieldName": "parent_process_name", + "displayName": "parent_process_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(parent_process_name) AND parent_process_name!=\"\",parent_process_name,isnotnull(parent_process) AND parent_process!=\"\",replace(parent_process,\"^\\s*([^\\s]+).*\",\"\\1\"),1=1,\"unknown\")" + }, + { + "calculationID": "Endpoint_Processes_fillnull_process", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The full command string of the spawned process. Such as C:\\WINDOWS\\system32\\cmd.exe \/c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell.cmd\" --scheme\"", + "recommended": true + }, + "fieldName": "process", + "displayName": "process", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(process) OR process=\"\",\"unknown\",process)" + }, + { + "calculationID": "Endpoint_Processes_fillnull_process_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The friendly name of the process, such as notepad.exe.", + "recommended": true + }, + "fieldName": "process_name", + "displayName": "process_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(process_name) AND process_name!=\"\",process_name,isnotnull(process) AND process!=\"\",replace(process,\"^\\s*([^\\s]+).*\",\"\\1\"),1=1,\"unknown\")" + }, + { + "calculationID": "Endpoint_Processes_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user account which spawned the process.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Endpoint_Processes_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the Endpoint solution that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Endpoint_indexes`) tag=process tag=report | eval process_integrity_level=lower(process_integrity_level)", + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "service", + "report" + ] + }, + "objectName": "Services", + "displayName": "Services", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The description of the service." + }, + "fieldName": "description", + "displayName": "description", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_is_expected", + "displayName": "dest_is_expected", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The globally unique identifier of the process assigned by the vendor_product." + }, + "fieldName": "process_guid", + "displayName": "process_guid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process assigned by the operating system." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The dynamic link library associated with the service." + }, + "fieldName": "service_dll", + "displayName": "service_dll", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The file path to the dynamic link library assocatied with the service, such as C:\\Windows\\System32\\comdlg32.dll." + }, + "fieldName": "service_dll_path", + "displayName": "service_dll_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The digest(s) of the dynamic link library associated with the service, such as , , etc." + }, + "fieldName": "service_dll_hash", + "displayName": "service_dll_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "Whether or not the dynamic link library associated with the service has a digitally signed signature." + }, + "fieldName": "service_dll_signature_exists", + "displayName": "service_dll_signature_exists", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Whether or not the dynamic link library associated with the service has had it's digitally signed signature verified." + }, + "fieldName": "service_dll_signature_verified", + "displayName": "service_dll_signature_verified", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The executable name of the service." + }, + "fieldName": "service_exec", + "displayName": "service_exec", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The digest(s) of the service, such as , , etc." + }, + "fieldName": "service_hash", + "displayName": "service_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The file path of the service, such as C:\\WINDOWS\\system32\\svchost.exe." + }, + "fieldName": "service_path", + "displayName": "service_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Whether or not the service has a digitally signed signature." + }, + "fieldName": "service_signature_exists", + "displayName": "service_signature_exists", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Whether or not the service has had it's digitally signed signature verified." + }, + "fieldName": "service_signature_verified", + "displayName": "service_signature_verified", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Endpoint_Services_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint for which the service is installed.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Endpoint_Services_fillnull_service", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The full service name.", + "recommended": true + }, + "fieldName": "service", + "displayName": "service", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(service) OR service=\"\",\"unknown\",service)" + }, + { + "calculationID": "Endpoint_Services_fillnull_service_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The friendly service name.", + "recommended": true + }, + "fieldName": "service_name", + "displayName": "service_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(service_name) OR service_name=\"\",\"unknown\",service_name)" + }, + { + "calculationID": "Endpoint_Services_fillnull_service_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The unique identifier of the service assigned by the operating system..", + "recommended": true + }, + "fieldName": "service_id", + "displayName": "service_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(service_id) OR service_id=\"\",\"unknown\",service_id)" + }, + { + "calculationID": "Endpoint_Services_fillnull_start_mode", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The start mode for the service.", + "expected_values": [ + "disabled", + "manual", + "auto" + ], + "recommended": true + }, + "fieldName": "start_mode", + "displayName": "start_mode", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(start_mode) OR start_mode=\"\",\"unknown\",start_mode)" + }, + { + "calculationID": "Endpoint_Services_fillnull_status", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The status of the service.", + "expected_values": [ + "critical", + "started", + "stopped", + "warning" + ], + "recommended": true + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(status) OR status=\"\",\"unknown\",status)" + }, + { + "calculationID": "Endpoint_Services_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user account associated with the service.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Endpoint_Services_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the Endpoint solution that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Endpoint_indexes`) tag=service tag=report", + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "endpoint", + "filesystem" + ] + }, + "objectName": "Filesystem", + "displayName": "Filesystem", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time the file (the object of the event) was accessed.", + "recommended": true + }, + "fieldName": "file_access_time", + "displayName": "file_access_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time the file (the object of the event) was created.", + "recommended": true + }, + "fieldName": "file_create_time", + "displayName": "file_create_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time the file (the object of the event) was altered.", + "recommended": true + }, + "fieldName": "file_modify_time", + "displayName": "file_modify_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The globally unique identifier of the process assigned by the vendor_product." + }, + "fieldName": "process_guid", + "displayName": "process_guid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process assigned by the operating system." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Endpoint_Filesystem_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action performed on the resource.", + "expected_values": [ + "acl_modified", + "created", + "deleted", + "modified", + "read" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Endpoint_Filesystem_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint pertaining to the filesystem activity.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Endpoint_Filesystem_eval_file_hash", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "A cryptographic identifier assigned to the file object affected by the event.", + "recommended": true + }, + "fieldName": "file_hash", + "displayName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_hash) OR file_hash=\"\",\"unknown\",file_hash)" + }, + { + "calculationID": "Endpoint_Filesystem_eval_file_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the file, such as notepad.exe.", + "recommended": true + }, + "fieldName": "file_name", + "displayName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_name) OR file_name=\"\",\"unknown\",file_name)" + }, + { + "calculationID": "Endpoint_Filesystem_eval_file_path", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The path of the file, such as C:\\Windows\\System32\\notepad.exe.", + "recommended": true + }, + "fieldName": "file_path", + "displayName": "file_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_path) OR file_path=\"\",\"unknown\",file_path)" + }, + { + "calculationID": "Endpoint_Filesystem_eval_file_acl", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Access controls associated with the file affected by the event.", + "recommended": true + }, + "fieldName": "file_acl", + "displayName": "file_acl", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_acl) OR file_acl=\"\",\"unknown\",file_acl)" + }, + { + "calculationID": "Endpoint_Filesystem_eval_file_size", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The size of the file that is the object of the event, in kilobytes.", + "recommended": true + }, + "fieldName": "file_size", + "displayName": "file_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnum(file_size),file_size,null())" + }, + { + "calculationID": "Endpoint_Filesystem_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user account associated with the filesystem access.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Endpoint_Filesystem_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the Endpoint solution that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Endpoint_indexes`) tag=endpoint tag=filesystem", + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "endpoint", + "registry" + ] + }, + "objectName": "Registry", + "displayName": "Registry", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The globally unique identifier of the process assigned by the vendor_product." + }, + "fieldName": "process_guid", + "displayName": "process_guid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process assigned by the operating system." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The logical grouping of registry keys, subkeys, and values.", + "expected_values": [ + "HKEY_CURRENT_CONFIG", + "HKEY_CURRENT_USER", + "HKEY_LOCAL_MACHINE\\SAM", + "HKEY_LOCAL_MACHINE\\Security", + "HKEY_LOCAL_MACHINE\\Software", + "HKEY_LOCAL_MACHINE\\System", + "HKEY_USERS\\.DEFAULT" + ], + "ta_relevant": false + }, + "fieldName": "registry_hive", + "displayName": "registry_hive", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The textual representation of registry_value_data (if applicable)." + }, + "fieldName": "registry_value_text", + "displayName": "registry_value_text", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The outcome of the registry action.", + "expected_values": [ + "failure", + "success" + ], + "ta_relevant": false + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Endpoint_Registry_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action performed on the resource.", + "expected_values": [ + "created", + "deleted", + "modified", + "read" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint pertaining to the registry events.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_registry_path", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The path to the registry value, such as \\win\\directory\\directory2\\{676235CD-B656-42D5-B737-49856E97D072}\\PrinterDriverData.", + "recommended": true + }, + "fieldName": "registry_path", + "displayName": "registry_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(registry_path) OR registry_path=\"\",\"unknown\",registry_path)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_registry_key_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the registry key, such as PrinterDriverData.", + "recommended": true + }, + "fieldName": "registry_key_name", + "displayName": "registry_key_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(registry_key_name) OR registry_key_name=\"\",\"unknown\",registry_key_name)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_registry_value_data", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The unaltered registry value.", + "recommended": true + }, + "fieldName": "registry_value_data", + "displayName": "registry_value_data", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(registry_value_data) OR registry_value_data=\"\",\"unknown\",registry_value_data)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_registry_value_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the registry value.", + "recommended": true + }, + "fieldName": "registry_value_name", + "displayName": "registry_value_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(registry_value_name) OR registry_value_name=\"\",\"unknown\",registry_value_name)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_registry_value_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The type of the registry value.", + "expected_values": [ + "REG_BINARY", + "REG_DWORD", + "REG_DWORD_LITTLE_ENDIAN", + "REG_DWORD_BIG_ENDIAN", + "REG_EXPAND_SZ", + "REG_LINK", + "REG_MULTI_SZ", + "REG_NONE", + "REG_QWORD", + "REG_QWORD_LITTLE_ENDIAN", + "REG_SZ" + ], + "recommended": true + }, + "fieldName": "registry_value_type", + "displayName": "registry_value_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(registry_value_type) OR registry_value_type=\"\",\"unknown\",registry_value_type)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user account associated with the registry access.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Endpoint_Registry_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the Endpoint solution that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Endpoint_indexes`) tag=endpoint tag=registry", + "children": [ + + ] + } + ] +} diff --git a/bin/datamodels/Event_Signatures.json b/bin/datamodels/Event_Signatures.json new file mode 100644 index 0000000000..f455c4412a --- /dev/null +++ b/bin/datamodels/Event_Signatures.json @@ -0,0 +1,136 @@ +{ + "modelName": "Event_Signatures", + "displayName": "Event Signatures", + "description": "Event Signatures Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "track_event_signatures" + ] + }, + "objectName": "Signatures", + "displayName": "Signatures", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "System affected by the signature." + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The human readable event name." + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The event name identifier (as supplied by the vendor)." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Signatures_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the technology that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Event_Signatures_indexes`) tag=track_event_signatures (signature=* OR signature_id=*)" + } + ], + "children": [] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Interprocess_Messaging.json b/bin/datamodels/Interprocess_Messaging.json new file mode 100644 index 0000000000..4dc4fc9daa --- /dev/null +++ b/bin/datamodels/Interprocess_Messaging.json @@ -0,0 +1,462 @@ +{ + "objectNameList": [ + + ], + "objectSummary": { + + }, + "displayName": "Interprocess Messaging", + "description": "", + "modelName": "Interprocess_Messaging", + "objects": [ + { + "comment": { + "tags": [ + "messaging" + ] + }, + "objectName": "All_Messaging", + "displayName": "All Interprocess Messaging", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The business unit of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of message destination.", + "expected_values": [ + "queue", + "topic" + ], + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of seconds from message call to message response. Can be derived by getting the difference between the request_sent_time and the message_received_time." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The endpoint that the message accessed during the RPC (remote procedure call) transaction." + }, + "fieldName": "endpoint", + "displayName": "endpoint", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The version of the endpoint accessed during the RPC (remote procedure call) transaction, such as 1.0 or 1.22." + }, + "fieldName": "endpoint_version", + "displayName": "endpoint_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The message identification." + }, + "fieldName": "message_id", + "displayName": "message_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A command or reference that an RPC (remote procedure call) reads or responds to." + }, + "fieldName": "message", + "displayName": "message", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time that the RPC (remote procedure call) read the message and was prepared to take some sort of action." + }, + "fieldName": "message_consumed_time", + "displayName": "message_consumed_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The message correlation identification value." + }, + "fieldName": "message_correlation_id", + "displayName": "message_correlation_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time that the message producer sent the message." + }, + "fieldName": "message_delivered_time", + "displayName": "message_delivered_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The message delivery mode. Possible values depend on the type of message-oriented middleware (MOM) solution in use. They can be words like Transient (meaning the message is stored in memory and is lost if the server dies or restarts) or Persistent (meaning the message is stored both in memory and on disk and is preserved if the server dies or restarts). They can also be numbers like 1, 2, and so on." + }, + "fieldName": "message_delivery_mode", + "displayName": "message_delivery_mode", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time that the message expired." + }, + "fieldName": "message_expiration_time", + "displayName": "message_expiration_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the message. Important jobs that the message queue should answer no matter what receive a higher message_priority than other jobs, ensuring they are completed before the others." + }, + "fieldName": "message_priority", + "displayName": "message_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time that the message was received by a message-oriented middleware (MOM) solution." + }, + "fieldName": "message_received_time", + "displayName": "message_received_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Indicates whether or not the message was redelivered." + }, + "fieldName": "message_redelivered", + "displayName": "message_redelivered", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the destination for replies to the message." + }, + "fieldName": "message_reply_dest", + "displayName": "message_reply_dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of message, such as call or reply." + }, + "fieldName": "message_type", + "displayName": "message_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "An arbitrary list of message properties. The set of properties displayed depends on the message-oriented middleware (MOM) solution that you are using." + }, + "fieldName": "message_properties", + "displayName": "message_properties", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "Arguments that have been passed to an endpoint by a REST call or something similar. A sample parameter could be something like foo=bar." + }, + "fieldName": "parameters", + "displayName": "parameters", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The message payload." + }, + "fieldName": "payload", + "displayName": "payload", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of payload in the message. The payload type can be text (such as json, xml, and raw) or binary (such as compressed, object, encrypted, and image)." + }, + "fieldName": "payload_type", + "displayName": "payload_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The content of the message request." + }, + "fieldName": "request_payload", + "displayName": "request_payload", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of payload in the message request. The payload type can be text (such as json, xml, and raw) or binary (such as compressed, object, encrypted, and image)." + }, + "fieldName": "request_payload_type", + "displayName": "request_payload_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time that the message request was sent." + }, + "fieldName": "request_sent_time", + "displayName": "request_sent_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The response status code sent by the receiving server. Ranges between 200 and 404." + }, + "fieldName": "response_code", + "displayName": "response_code", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time that the message response was received." + }, + "fieldName": "response_received_time", + "displayName": "response_received_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of payload in the message response. The payload type can be text (such as json, xml, and raw) or binary (such as compressed, object, encrypted, and image)." + }, + "fieldName": "response_payload_type", + "displayName": "response_payload_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The response status message sent by the message server." + }, + "fieldName": "return_message", + "displayName": "return_message", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The protocol that the message server uses for remote procedure calls (RPC). Possible values include HTTP REST, SOAP, and EJB." + }, + "fieldName": "rpc_protocol", + "displayName": "rpc_protocol", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status of the message response.", + "expected_values": [ + "pass", + "fail" + ] + }, + "fieldName": "status", + "displayName": "status", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_interprocess_messaging_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination of the message. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name." + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + } + ], + "constraints": [ + { + "search": "(`cim_Interprocess_Messaging_indexes`) tag=messaging" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Intrusion_Detection.json b/bin/datamodels/Intrusion_Detection.json new file mode 100644 index 0000000000..2bf0f00f84 --- /dev/null +++ b/bin/datamodels/Intrusion_Detection.json @@ -0,0 +1,583 @@ +{ + "modelName": "Intrusion_Detection", + "displayName": "Intrusion Detection", + "description": "Intrusion Detection Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "ids", + "attack" + ] + }, + "objectName": "IDS_Attacks", + "displayName": "IDS Attacks", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The action taken by the intrusion detection system (IDS).", + "expected_values": [ + "allowed", + "blocked" + ] + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The destination port of the intrusion." + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_bunit", + "displayName": "dvc_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_category", + "displayName": "dvc_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_priority", + "displayName": "dvc_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A cryptographic identifier assigned to the file object affected by the event.", + "ta_relevant": false + }, + "fieldName": "file_hash", + "displayName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the file, such as notepad.exe.", + "ta_relevant": false + }, + "fieldName": "file_name", + "displayName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The path of the file, such as C:\\Windows\\System32\\notepad.exe.", + "ta_relevant": false + }, + "fieldName": "file_path", + "displayName": "file_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The port number of the source." + }, + "fieldName": "src_port", + "displayName": "src_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The OSI layer 4 (transport) protocol of the intrusion, in lower case." + }, + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "IDS_Attacks_fillnull_dvc", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The device that detected the intrusion event. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.", + "recommended": true + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)" + }, + { + "calculationID": "IDS_Attacks_fillnull_ids_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The type of IDS that generated the event.", + "expected_values": [ + "network", + "host", + "application", + "wireless" + ], + "recommended": true + }, + "fieldName": "ids_type", + "displayName": "ids_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(ids_type) OR ids_type=\"\",\"unknown\",ids_type)" + }, + { + "calculationID": "IDS_Attacks_fillnull_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor-provided category of the triggered signature, such as spyware. Note: This field is a string. Use a category_id field for category ID fields that are integer data types (category_id fields are optional, so they are not included in this table).", + "recommended": true + }, + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(category) OR category=\"\",\"unknown\",category)" + }, + { + "calculationID": "IDS_Attacks_fillnull_signature", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the intrusion detected on the client (the src), such as PlugAndPlay_BO and JavaScript_Obfuscation_Fre. Note: This is a string value. Use signature_id for numeric indicators. The signature_id field is optional, so it is not included in the model.", + "recommended": true + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)" + }, + { + "calculationID": "IDS_Attacks_fillnull_severity", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The severity of the network protection event. Note: This field is a string. Use severity_id for severity ID fields that are integer data types. The severity_id field is optional, so it is not included in the model. Also, specific values are required for this field. Use vendor_severity for the vendor's own human readable severity strings, such as Good, Bad, and Really Bad.", + "expected_values": [ + "critical", + "high", + "medium", + "low", + "informational" + ], + "recommended": true + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)" + }, + { + "calculationID": "IDS_Attacks_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source involved in the attack detected by the IDS. You can alias this from more specific fields, such as src_host, src_ip, or src_name.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "IDS_Attacks_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination of the attack detected by the intrusion detection system (IDS). You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "IDS_Attacks_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user involved with the intrusion detection event.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "IDS_Attacks_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the IDS or IPS system that detected the vulnerability, such as HP Tipping Point. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Intrusion_Detection_indexes`) tag=ids tag=attack" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "ids", + "attack" + ] + }, + "objectName": "Application_IDS_Attacks", + "displayName": "Application Intrusion Detection", + "parentName": "IDS_Attacks", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "ids_type=\"application\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "ids", + "attack" + ] + }, + "objectName": "Host_IDS_Attacks", + "displayName": "Host Intrusion Detection", + "parentName": "IDS_Attacks", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "ids_type=\"host\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "ids", + "attack" + ] + }, + "objectName": "Network_IDS_Attacks", + "displayName": "Network Intrusion Detection", + "parentName": "IDS_Attacks", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "ids_type=\"network\"" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/JVM.json b/bin/datamodels/JVM.json new file mode 100644 index 0000000000..81c6b76741 --- /dev/null +++ b/bin/datamodels/JVM.json @@ -0,0 +1,824 @@ +{ + "modelName": "JVM", + "displayName": "JVM", + "description": "Java Virtual Machine Data Model", + "objects": [ + { + "comment": { + "tags": [ + "jvm" + ] + }, + "objectName": "JVM", + "displayName": "JVM", + "parentName": "BaseEvent", + "calculations": [ + + ], + "constraints": [ + { + "search": "(`cim_JVM_indexes`) tag=jvm" + } + ], + "fields": [ + { + "comment": { + "description": "A description field provided in some data sources." + }, + "fieldName": "jvm_description", + "displayName": "jvm_description", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ] + }, + { + "comment": { + "tags": [ + "jvm", + "threading" + ] + }, + "objectName": "Threading", + "displayName": "Threading", + "parentName": "JVM", + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=threading" + } + ], + "fields": [ + { + "comment": { + "description": "The total number of threads started in the JVM." + }, + "fieldName": "threads_started", + "displayName": "threads_started", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Indicates whether thread CPU time measurement is enabled.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "cpu_time_enabled", + "displayName": "cpu_time_enabled", + "type": "boolean", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "The JVM's current thread count." + }, + "fieldName": "thread_count", + "displayName": "thread_count", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Indicates whether the JVM supports thread contention monitoring.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "cm_supported", + "displayName": "cm_supported", + "type": "boolean", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Indicates whether thread contention monitoring is enabled.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "cm_enabled", + "displayName": "cm_enabled", + "type": "boolean", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Indicates whether the JVM supports monitoring of ownable synchronizer usage.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "synch_supported", + "displayName": "synch_supported", + "type": "boolean", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "The JVM's peak thread count." + }, + "fieldName": "peak_thread_count", + "displayName": "peak_thread_count", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Indicates whether the JVM supports monitoring of object monitor usage.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "omu_supported", + "displayName": "omu_supported", + "type": "boolean", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "The JVM's current daemon count." + }, + "fieldName": "daemon_thread_count", + "displayName": "daemon_thread_count", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "User-space time taken by the JVM, in seconds." + }, + "fieldName": "current_user_time", + "displayName": "current_user_time", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Indicates whether the Java virtual machine supports CPU time measurement for the current thread.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "cpu_time_supported", + "displayName": "cpu_time_supported", + "type": "boolean", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "CPU-space time taken by the JVM, in seconds." + }, + "fieldName": "current_cpu_time", + "displayName": "current_cpu_time", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ] + }, + { + "comment": { + "tags": [ + "jvm", + "runtime" + ] + }, + "objectName": "Runtime", + "displayName": "Runtime", + "parentName": "JVM", + "constraints": [ + { + "search": "tag=runtime" + } + ], + "fields": [ + { + "comment": { + "description": "Version of the JVM." + }, + "fieldName": "version", + "displayName": "version", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Uptime of the JVM process, in seconds." + }, + "fieldName": "uptime", + "displayName": "uptime", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Start time of the JVM process." + }, + "fieldName": "start_time", + "displayName": "start_time", + "type": "timestamp", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Process name of the JVM process." + }, + "fieldName": "process_name", + "displayName": "process_name", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ], + "calculations": [ + { + "calculationID": "Runtime_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The JVM product or service. This field can be automatically populated by the the vendor and product fields in your raw data." + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ] + }, + { + "comment": { + "tags": [ + "jvm", + "os" + ] + }, + "objectName": "OS", + "displayName": "OS", + "parentName": "JVM", + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=os" + } + ], + "fields": [ + { + "comment": { + "description": "OS version that the JVM is running on." + }, + "fieldName": "os_version", + "displayName": "os_version", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Swap memory space available to the OS that the JVM is running on, in bytes." + }, + "fieldName": "swap_space", + "displayName": "swap_space", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Physical memory available to the OS that the JVM is running on, in bytes." + }, + "fieldName": "physical_memory", + "displayName": "physical_memory", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "System load of the OS that the JVM is running on." + }, + "fieldName": "system_load", + "displayName": "system_load", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Amount of CPU time taken by the JVM, in seconds." + }, + "fieldName": "cpu_time", + "displayName": "cpu_time", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "OS that the JVM is running on." + }, + "fieldName": "os", + "displayName": "os", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Number of file descriptors opened by the JVM." + }, + "fieldName": "open_file_descriptors", + "displayName": "open_file_descriptors", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Maximum file descriptors available to the JVM." + }, + "fieldName": "max_file_descriptors", + "displayName": "max_file_descriptors", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Amount of free swap memory remaining to the JVM, in bytes." + }, + "fieldName": "free_swap", + "displayName": "free_swap", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Amount of free physical memory remaining to the JVM, in bytes." + }, + "fieldName": "free_physical_memory", + "displayName": "free_physical_memory", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Amount of memory committed to the JVM, in bytes." + }, + "fieldName": "committed_memory", + "displayName": "committed_memory", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Total processor cores available to the OS that the JVM is running on." + }, + "fieldName": "total_processors", + "displayName": "total_processors", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "OS architecture that the JVM is running on." + }, + "fieldName": "os_architecture", + "displayName": "os_architecture", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ] + }, + { + "comment": { + "tags": [ + "jvm", + "compilation" + ] + }, + "objectName": "Compilation", + "displayName": "Compilation", + "parentName": "JVM", + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=compilation" + } + ], + "fields": [ + { + "comment": { + "description": "Time taken by JIT compilation, in seconds." + }, + "fieldName": "compilation_time", + "displayName": "compilation_time", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ] + }, + { + "comment": { + "tags": [ + "jvm", + "classloading" + ] + }, + "objectName": "Classloading", + "displayName": "Classloading", + "parentName": "JVM", + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=classloading" + } + ], + "fields": [ + { + "comment": { + "description": "The total count of classes loaded in the JVM." + }, + "fieldName": "total_loaded", + "displayName": "total_loaded", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "The current count of classes loaded in the JVM." + }, + "fieldName": "current_loaded", + "displayName": "current_loaded", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "The total count of classes unloaded from the JVM." + }, + "fieldName": "total_unloaded", + "displayName": "total_unloaded", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ] + }, + { + "comment": { + "tags": [ + "jvm", + "memory" + ] + }, + "objectName": "Memory", + "displayName": "Memory", + "parentName": "JVM", + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=memory" + } + ], + "fields": [ + { + "comment": { + "description": "Non-heap memory used by the JVM, in bytes." + }, + "fieldName": "non_heap_used", + "displayName": "non_heap_used", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Maximum amount of non-heap memory used by the JVM, in bytes." + }, + "fieldName": "non_heap_max", + "displayName": "non_heap_max", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Initial amount of non-heap memory used by the JVM, in bytes." + }, + "fieldName": "non_heap_initial", + "displayName": "non_heap_initial", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Committed amount of non-heap memory used by the JVM, in bytes." + }, + "fieldName": "non_heap_committed", + "displayName": "non_heap_committed", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Heap memory used by the JVM, in bytes." + }, + "fieldName": "heap_used", + "displayName": "heap_used", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Maximum amount of heap memory used by the JVM, in bytes." + }, + "fieldName": "heap_max", + "displayName": "heap_max", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Initial amount of heap memory used by the JVM, in bytes." + }, + "fieldName": "heap_initial", + "displayName": "heap_initial", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Committed amount of heap memory used by the JVM, in bytes." + }, + "fieldName": "heap_committed", + "displayName": "heap_committed", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Number of objects pending in the JVM." + }, + "fieldName": "objects_pending", + "displayName": "objects_pending", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Malware.json b/bin/datamodels/Malware.json new file mode 100644 index 0000000000..8d1e12e2ff --- /dev/null +++ b/bin/datamodels/Malware.json @@ -0,0 +1,723 @@ +{ + "modelName": "Malware", + "displayName": "Malware", + "description": "Malware Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "malware", + "attack" + ] + }, + "objectName": "Malware_Attacks", + "displayName": "Malware Attacks", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The hash of the file with suspected malware." + }, + "fieldName": "file_hash", + "displayName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the file with suspected malware." + }, + "fieldName": "file_name", + "displayName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The full file path of the file with suspected malware." + }, + "fieldName": "file_path", + "displayName": "file_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source of the endpoint event, such as a DAT file relay server. You can alias this from more specific fields, such as src_host, src_ip, or src_name." + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the source.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the source.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the source.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The reported sender of an email-based attack." + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "A URL containing more information about the vulnerability." + }, + "fieldName": "url", + "displayName": "url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Malware_Attacks_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action taken by the reporting device.", + "expected_values": [ + "allowed", + "blocked", + "deferred" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Malware_Attacks_fillnull_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The category of the malware event, such as keylogger or ad-supported program. Note: This is a string value. Use category_id for category ID fields that are integer data types. The category_id field is optional, so it is not included in the data model.", + "recommended": true + }, + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(category) OR category=\"\",\"unknown\",category)" + }, + { + "calculationID": "Malware_Attacks_date", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The date of the malware event.", + "recommended": true + }, + "fieldName": "date", + "displayName": "date", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "strftime(_time, \"%m-%d-%Y\")" + }, + { + "calculationID": "Malware_Attacks_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system that was affected by the malware event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Malware_Attacks_fillnull_dest_nt_domain", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NT domain of the destination, if applicable.", + "recommended": true + }, + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest_nt_domain) OR dest_nt_domain=\"\",\"unknown\",dest_nt_domain)" + }, + { + "calculationID": "Malware_Attacks_fillnull_severity", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The severity of the network protection event. Note: This field is a string. Use severity_id for severity ID fields that are integer data types. The severity_id field is optional, so it is not included in the model. Also, specific values are required for this field. Use vendor_severity for the vendor's own human readable severity strings, such as Good, Bad, and Really Bad.", + "expected_values": [ + "critical", + "high", + "medium", + "low", + "informational" + ], + "recommended": true + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)" + }, + { + "calculationID": "Malware_Attacks_fillnull_signature", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the malware infection detected on the client (the dest), such as Trojan.Vundo, Spyware.Gaobot, and W32.Nimbda. Note: This is a string value. Use signature_id for signature ID fields that are integer data types. The signature_id field is optional, so it is not included in the data model.", + "recommended": true + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)" + }, + { + "calculationID": "Malware_Attacks_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user involved in the malware event.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Malware_Attacks_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the endpoint protection system, such as Symantec AntiVirus. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Malware_indexes`) tag=malware tag=attack" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "malware", + "attack" + ] + }, + "objectName": "Allowed_Malware", + "displayName": "Allowed Malware", + "parentName": "Malware_Attacks", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"allowed\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "malware", + "attack" + ] + }, + "objectName": "Blocked_Malware", + "displayName": "Blocked Malware", + "parentName": "Malware_Attacks", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"blocked\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "malware", + "attack" + ] + }, + "objectName": "Deferred_Malware", + "displayName": "Quarantined Malware", + "parentName": "Malware_Attacks", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"deferred\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "malware", + "operations" + ] + }, + "objectName": "Malware_Operations", + "displayName": "Malware Operations", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The event timestamp expressed in Unix time.", + "ta_relevant": false + }, + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The product version of the malware operations product.", + "recommended": true + }, + "fieldName": "product_version", + "displayName": "product_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The version of the malware signature bundle in a signature update operations event.", + "recommended": true + }, + "fieldName": "signature_version", + "displayName": "signature_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Malware_Operations_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system where the malware operations event occurred.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Malware_Operations_fillnull_dest_nt_domain", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NT domain of the dest system, if applicable.", + "recommended": true + }, + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest_nt_domain) OR dest_nt_domain=\"\",\"unknown\",dest_nt_domain)" + }, + { + "calculationID": "Malware_Operations_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor product name of the malware operations product.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Malware_indexes`) tag=malware tag=operations | tags outputfield=tag", + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Network_Resolution.json b/bin/datamodels/Network_Resolution.json new file mode 100644 index 0000000000..749524ff65 --- /dev/null +++ b/bin/datamodels/Network_Resolution.json @@ -0,0 +1,506 @@ +{ + "modelName": "Network_Resolution", + "displayName": "Network Resolution (DNS)", + "description": "Network Resolution Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "network", + "resolution", + "dns" + ] + }, + "objectName": "DNS", + "displayName": "DNS", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "Number of entries in the 'additional' section of the DNS message." + }, + "fieldName": "additional_answer_count", + "displayName": "additional_answer_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Number of entries in the 'authority' section of the DNS message." + }, + "fieldName": "authority_answer_count", + "displayName": "authority_answer_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the network resolution target, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The destination port number." + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the destination, if applicable.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time taken by the network resolution event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the DNS event." + }, + "fieldName": "name", + "displayName": "name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Number of entries that appear in the 'Questions' section of the DNS query.", + "expected_values": [ + "Query", + "IQuery", + "Status", + "Notify", + "Update", + "A", + "MX", + "NS", + "PTR" + ] + }, + "fieldName": "query_type", + "displayName": "query_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The DNS resource record type. For details, see the List of DNS record types on Wikipedia.", + "expected_values": [ + "A", + "DNAME", + "MX", + "NS", + "PTR" + ] + }, + "fieldName": "record_type", + "displayName": "record_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response in the network resolution event, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source of the network resolution event. You can alias this from more specific fields, such as src_host, src_ip, or src_name." + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the source, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The port number of the source." + }, + "fieldName": "src_port", + "displayName": "src_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the source.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The transport protocol used by the network resolution event." + }, + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique numerical transaction id of the network resolution event." + }, + "fieldName": "transaction_id", + "displayName": "transaction_id", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time-to-live of the network resolution event, in seconds." + }, + "fieldName": "ttl", + "displayName": "ttl", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "DNS_0fillnull_answer", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Resolved address for the query.", + "recommended": true + }, + "fieldName": "answer", + "displayName": "answer", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(answer) OR answer=\"\",\"unknown\",answer)" + }, + { + "calculationID": "DNS_answer_count", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Number of entries in the answer section of the DNS message.", + "ta_relevant": false + }, + "fieldName": "answer_count", + "displayName": "answer_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(answer_count),answer_count,isnotnull(answer),mvcount(answer),1=1,1)" + }, + { + "calculationID": "DNS_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination of the network resolution event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "DNS_fillnull_message_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Type of DNS message.", + "expected_values": [ + "Query", + "Response" + ], + "recommended": true + }, + "fieldName": "message_type", + "displayName": "message_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(message_type) OR message_type=\"\",\"unknown\",message_type)" + }, + { + "calculationID": "DNS_0fillnull_query", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The domain which needs to be resolved. Applies to messages of type 'Query'.", + "recommended": true + }, + "fieldName": "query", + "displayName": "query", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(query) OR query=\"\",\"unknown\",query)" + }, + { + "calculationID": "DNS_query_count", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Number of entries that appear in the 'Questions' section of the DNS query.", + "ta_relevant": false + }, + "fieldName": "query_count", + "displayName": "query_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(query_count),query_count,isnotnull(query),mvcount(query),1=1,1)" + }, + { + "calculationID": "DNS_0fillnull_reply_code_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The numerical id or name of a return code. For details, see the Domain Name System Parameters on the Internet Assigned Numbers Authority (IANA) web site.", + "expected_values": [ + "0", + "NoError", + "1", + "FormErr", + "2", + "ServFail", + "3", + "NXDomain", + "etc." + ], + "recommended": true + }, + "fieldName": "reply_code_id", + "displayName": "reply_code_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(reply_code_id) AND reply_code_id!=\"\",reply_code_id,isnotnull(reply_code) AND reply_code!=\"\",reply_code,1=1,\"unknown\")" + }, + { + "calculationID": "DNS_reply_code", + "calculationType": "Lookup", + "lookupName": "cim_dns_reply_code_lookup", + "lookupInputs": [ + { + "inputField": "reply_code_id", + "lookupField": "reply_code_id" + } + ], + "outputFields": [ + { + "comment": { + "description": "The return code for the response. For details, see the Domain Name System Parameters on the Internet Assigned Numbers Authority (IANA) web site.", + "expected_values": [ + "No Error", + "Format Error", + "Server Failure", + "Non-Existent Domain", + "etc." + ], + "recommended": true + }, + "lookupOutputFieldName": "reply_code", + "fieldName": "reply_code", + "displayName": "reply_code", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ] + }, + { + "calculationID": "DNS_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor product name of the DNS server. The Splunk platform can derive this field from the fields vendor and product in the raw data, if they exist.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Network_Resolution_indexes`) tag=network tag=resolution tag=dns" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Network_Sessions.json b/bin/datamodels/Network_Sessions.json new file mode 100644 index 0000000000..e075195278 --- /dev/null +++ b/bin/datamodels/Network_Sessions.json @@ -0,0 +1,516 @@ +{ + "modelName": "Network_Sessions", + "displayName": "Network Sessions", + "description": "Network Sessions Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "network", + "session" + ] + }, + "objectName": "All_Sessions", + "displayName": "All Sessions", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The action taken by the reporting device." + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time for the completion of the network session event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response in the network session event, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "An indication of the type of network session event." + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the source.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the source.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The external domain name of the client initializing a network session. Not applicable for DHCP events." + }, + "fieldName": "src_dns", + "displayName": "src_dns", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The IP address of the client initializing a network session. Not applicable for DHCP events." + }, + "fieldName": "src_ip", + "displayName": "src_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The MAC address of the client initializing a network session. Not applicable for DHCP events." + }, + "fieldName": "src_mac", + "displayName": "src_mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The NetBIOS name of the client initializing a network session. Not applicable for DHCP events." + }, + "fieldName": "src_nt_host", + "displayName": "src_nt_host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the source.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The business unit associated with the user.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the user.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Sessions_fillnull_dest_ip", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The internal IP address allocated to the client initializing a network session. For DHCP and VPN events, this is the IP address leased to the client.", + "recommended": true + }, + "fieldName": "dest_ip", + "displayName": "dest_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(source LIKE \"stream%\" AND isnotnull(yiaddr) AND yiaddr!=\"\",yiaddr,isnull(dest_ip) OR dest_ip=\"\",\"unknown\",1=1,dest_ip)" + }, + { + "calculationID": "All_Sessions_fillnull_dest_mac", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The internal MAC address of the network session client. For DHCP events, this is the MAC address of the client acquiring an IP address lease. For VPN events, this is the MAC address of the client initializing a network session.", + "recommended": true + }, + "fieldName": "dest_mac", + "displayName": "dest_mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(source LIKE \"stream%\" AND isnotnull(chaddr) AND chaddr!=\"\",chaddr,isnull(dest_mac) OR dest_mac=\"\",\"unknown\",1=1,dest_mac)" + }, + { + "calculationID": "All_Sessions_fillnull_dest_nt_host", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NetBIOS name of the client initializing a network session.", + "recommended": true + }, + "fieldName": "dest_nt_host", + "displayName": "dest_nt_host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest_nt_host) OR dest_nt_host=\"\",\"unknown\",dest_nt_host)" + }, + { + "calculationID": "All_Sessions_fillnull_dest_dns", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The domain name system address of the destination for a network session event.", + "recommended": true + }, + "fieldName": "dest_dns", + "displayName": "dest_dns", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest_dns) OR dest_dns=\"\",\"unknown\",dest_dns)" + }, + { + "calculationID": "All_Sessions_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user in a network session event, where applicable. For example, a VPN session or an authenticated DHCP event.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "All_Sessions_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The full name of the Dynamic Host Configuration Protocol (DHCP) or DNS server involved in this event including vendor and product name, such as Microsoft DHCP or ISC BIND. This field is generated by combining the values of the vendor and product fields.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Network_Sessions_indexes`) tag=network tag=session" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "session", + "start" + ] + }, + "objectName": "Session_Start", + "displayName": "Session Start", + "parentName": "All_Sessions", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=start" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "session", + "end" + ] + }, + "objectName": "Session_End", + "displayName": "Session End", + "parentName": "All_Sessions", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=end" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "session", + "dhcp" + ] + }, + "objectName": "DHCP", + "displayName": "DHCP", + "parentName": "All_Sessions", + "fields": [ + { + "comment": { + "description": "The duration of the Dynamic Host Configuration Protocol (DHCP) lease, in seconds." + }, + "fieldName": "lease_duration", + "displayName": "lease_duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The consecutive range of possible IP addresses that the Dynamic Host Configuration Protocol (DHCP) server can lease to clients on a subnet. A lease_scope typically defines a single physical subnet on your network to which DHCP services are offered." + }, + "fieldName": "lease_scope", + "displayName": "lease_scope", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=dhcp" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "session", + "vpn" + ] + }, + "objectName": "VPN", + "displayName": "VPN", + "parentName": "All_Sessions", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=vpn" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Network_Traffic.json b/bin/datamodels/Network_Traffic.json new file mode 100644 index 0000000000..c1f53cfd14 --- /dev/null +++ b/bin/datamodels/Network_Traffic.json @@ -0,0 +1,1026 @@ +{ + "modelName": "Network_Traffic", + "displayName": "Network Traffic", + "description": "Network Traffic Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "network", + "communicate" + ] + }, + "objectName": "All_Traffic", + "displayName": "All Traffic", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The application protocol of the traffic." + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The 802.11 channel used by a wireless network." + }, + "fieldName": "channel", + "displayName": "channel", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The interface that is listening remotely or receiving packets locally. Can also be referred to as the 'egress interface.'" + }, + "fieldName": "dest_interface", + "displayName": "dest_interface", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The IP address of the destination." + }, + "fieldName": "dest_ip", + "displayName": "dest_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The destination TCP\/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field and use colons instead of dashes, spaces, or no separator." + }, + "fieldName": "dest_mac", + "displayName": "dest_mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The destination priority, if applicable.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The NATed IPv4 or IPv6 address to which a packet has been sent." + }, + "fieldName": "dest_translated_ip", + "displayName": "dest_translated_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The NATed port to which a packet has been sent. Note: Do not translate the values of this field to strings (tcp\/80 is 80, not http)." + }, + "fieldName": "dest_translated_port", + "displayName": "dest_translated_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The network zone of the destination." + }, + "fieldName": "dest_zone", + "displayName": "dest_zone", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The direction the packet is traveling.", + "expected_values": [ + "inbound", + "outbound" + ] + }, + "fieldName": "direction", + "displayName": "direction", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time for the completion of the network event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The ip address of the device." + }, + "fieldName": "dvc_ip", + "displayName": "dvc_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_bunit", + "displayName": "dvc_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_category", + "displayName": "dvc_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The device TCP\/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field and use colons instead of dashes, spaces, or no separator." + }, + "fieldName": "dvc_mac", + "displayName": "dvc_mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_priority", + "displayName": "dvc_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The network zone of the device." + }, + "fieldName": "dvc_zone", + "displayName": "dvc_zone", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Unique identifier for this traffic stream, such as a netflow, jflow, or cflow." + }, + "fieldName": "flow_id", + "displayName": "flow_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The RFC 2780 or RFC 4443 human-readable code value of the traffic, such as Destination Unreachable or Parameter Problem . See the ICMP Type Numbers and the ICMPv6 Type Numbers." + }, + "fieldName": "icmp_code", + "displayName": "icmp_code", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The RFC 2780 or RFC 4443 numeric value of the traffic. See the ICMP Type Numbers and the ICMPv6 Type Numbers.", + "expected_values": [ + "0-254" + ] + }, + "fieldName": "icmp_type", + "displayName": "icmp_type", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process assigned by the operating system." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The OSI layer 3 (network) protocol of the traffic observed, in lower case. For example, ip, appletalk, ipx." + }, + "fieldName": "protocol", + "displayName": "protocol", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Version of the OSI layer 3 protocol." + }, + "fieldName": "protocol_version", + "displayName": "protocol_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response in the network event, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The session identifier. Multiple transactions build a session." + }, + "fieldName": "session_id", + "displayName": "session_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the network traffic source.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the network traffic source.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The interface that is listening locally or sending packets remotely. Can also be referred to as the 'ingress interface.'", + "ta_relevant": false + }, + "fieldName": "src_interface", + "displayName": "src_interface", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The ip address of the source." + }, + "fieldName": "src_ip", + "displayName": "src_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source TCP\/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field and use colons instead of dashes, spaces, or no separator." + }, + "fieldName": "src_mac", + "displayName": "src_mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the source, if applicable.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The NATed IPv4 or IPv6 address from which a packet has been sent." + }, + "fieldName": "src_translated_ip", + "displayName": "src_translated_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The NATed port from which a packet has been sent. Note: Do not translate the values of this field to strings (tcp\/80 is 80, not http)." + }, + "fieldName": "src_translated_port", + "displayName": "src_translated_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The network zone of the source." + }, + "fieldName": "src_zone", + "displayName": "src_zone", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The 802.11 service set identifier (ssid) assigned to a wireless session." + }, + "fieldName": "ssid", + "displayName": "ssid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The TCP flag or multiple flags specified in the event.", + "expected_values": [ + "SYN", + "ACK", + "FIN", + "RST", + "URG", + "PSH" + ] + }, + "fieldName": "tcp_flag", + "displayName": "tcp_flag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The combination of source and destination IP ToS (type of service) values in the event." + }, + "fieldName": "tos", + "displayName": "tos", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The 'time to live' of a packet or diagram, in seconds." + }, + "fieldName": "ttl", + "displayName": "ttl", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The virtual local area network (VLAN) specified in the record." + }, + "fieldName": "vlan", + "displayName": "vlan", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The wireless standard(s) in use, such as 802.11a, 802.11b, 802.11g, or 802.11n." + }, + "fieldName": "wifi", + "displayName": "wifi", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The account associated with the network traffic." + }, + "fieldName": "vendor_account", + "displayName": "vendor_account", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Traffic_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action taken by the network device.", + "expected_values": [ + "allowed", + "blocked", + "teardown" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "All_Traffic_bytes", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Total count of bytes handled by this device\/interface (bytes_in + bytes_out).", + "recommended": true + }, + "fieldName": "bytes", + "displayName": "bytes", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(bytes),bytes,isnum(bytes_in) AND isnum(bytes_out),bytes_in+bytes_out,1=1,null())" + }, + { + "calculationID": "All_Traffic_bytes_in", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "How many bytes this device\/interface received.", + "recommended": true + }, + "fieldName": "bytes_in", + "displayName": "bytes_in", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(bytes_in),bytes_in,isnum(bytes) AND isnum(bytes_out),bytes-bytes_out,1=1,null())" + }, + { + "calculationID": "All_Traffic_bytes_out", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "How many bytes this device\/interface transmitted.", + "recommended": true + }, + "fieldName": "bytes_out", + "displayName": "bytes_out", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(bytes_out),bytes_out,isnum(bytes) AND isnum(bytes_in),bytes-bytes_in,1=1,null())" + }, + { + "calculationID": "All_Traffic_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination of the network traffic (the remote host). You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "All_Traffic_fillnull_dest_port", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination port of the network traffic. Note: Do not translate the value of this field to a string (tcp\/80 is 80, not http). You can set up the corresponding string value in the dest_svc field.", + "recommended": true + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnum(dest_port),dest_port,0)" + }, + { + "calculationID": "All_Traffic_fillnull_dvc", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The device that reported the traffic event. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.", + "recommended": true + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)" + }, + { + "calculationID": "All_Traffic_packets", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The total count of packets handled by this device\/interface (packets_in + packets_out)." + }, + "fieldName": "packets", + "displayName": "packets", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(packets),packets,isnum(packets_in) AND isnum(packets_out),packets_in+packets_out,1=1,null())" + }, + { + "calculationID": "All_Traffic_packets_in", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The total count of packets received by this device\/interface." + }, + "fieldName": "packets_in", + "displayName": "packets_in", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(packets_in),packets_in,isnum(packets) AND isnum(packets_out),packets-packets_out,1=1,null())" + }, + { + "calculationID": "All_Traffic_packets_out", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The total count of packets transmitted by this device\/interface." + }, + "fieldName": "packets_out", + "displayName": "packets_out", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(packets_out),packets_out,isnum(packets) AND isnum(packets_in),packets-packets_in,1=1,null())" + }, + { + "calculationID": "All_Traffic_fillnull_rule", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The rule which defines the action that was taken in the network event. Note: This is a string value. Use rule_id for rule fields that are integer data types. The rule_id field is optional, so it is not included in the data model.", + "recommended": true + }, + "fieldName": "rule", + "displayName": "rule", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(rule) OR rule=\"\",\"unknown\",rule)" + }, + { + "calculationID": "All_Traffic_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source of the network traffic (the client requesting the connection). You can alias this from more specific fields, such as src_host, src_ip, or src_name.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "All_Traffic_fillnull_src_port", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source port of the network traffic. Note: Do not translate the value of this field to a string (tcp\/80 is 80, not http). You can set up the corresponding string value in the src_svc field.", + "recommended": true + }, + "fieldName": "src_port", + "displayName": "src_port", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnum(src_port),src_port,0)" + }, + { + "calculationID": "All_Traffic_fillnull_transport", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The OSI layer 4 (transport) protocol of the traffic observed, in lower case.", + "expected_values": [ + "tcp", + "udp", + "icmp" + ], + "recommended": true + }, + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(transport) OR transport=\"\",\"unknown\",lower(transport))" + }, + { + "calculationID": "All_Traffic_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user that requested the traffic flow.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "All_Traffic_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product of the device generating the network event. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Network_Traffic_indexes`) tag=network tag=communicate" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "communicate" + ] + }, + "objectName": "Traffic_By_Action", + "displayName": "Traffic By Action", + "parentName": "All_Traffic", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=*" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "communicate" + ] + }, + "objectName": "Allowed_Traffic", + "displayName": "Allowed Traffic", + "parentName": "Traffic_By_Action", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=allowed" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "communicate" + ] + }, + "objectName": "Blocked_Traffic", + "displayName": "Blocked Traffic", + "parentName": "Traffic_By_Action", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=blocked" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Performance.json b/bin/datamodels/Performance.json new file mode 100644 index 0000000000..c45c0c0033 --- /dev/null +++ b/bin/datamodels/Performance.json @@ -0,0 +1,844 @@ +{ + "modelName": "Performance", + "displayName": "Performance", + "description": "Performance Data Model", + "editable": false, + "objects": [ + { + "comment": { + "ta_relevant": false + }, + "objectName": "All_Performance", + "displayName": "All Performance", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The business unit of the system where the event occurred. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the system where the event occurred. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the system where the performance event occurred.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Indicates whether or not the system where the performance event occurred should time sync. This field is automatically provided by Asset and Identity correlation features of applications like the Splunk App for Enterprise Security.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Indicates whether or not the system where the performance event occurred should update. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The ID of the virtualization hypervisor." + }, + "fieldName": "hypervisor_id", + "displayName": "hypervisor_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of facilities resource involved in the performance event, such as a rack, room, or system." + }, + "fieldName": "resource_type", + "displayName": "resource_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Performance_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system where the event occurred, usually a facilities resource such as a rack or room. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + } + ], + "constraints": [ + { + "search": "(`cim_Performance_indexes`) tag=performance (tag=cpu OR tag=facilities OR tag=memory OR tag=storage OR tag=network OR (tag=os ((tag=time tag=synchronize) OR tag=uptime)))" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "cpu" + ] + }, + "objectName": "CPU", + "displayName": "CPU", + "parentName": "All_Performance", + "fields": [ + { + "comment": { + "description": "The amount of CPU load reported by the controller in megahertz." + }, + "fieldName": "cpu_load_mhz", + "displayName": "cpu_load_mhz", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of CPU load reported by the controller in percentage points.", + "recommended": true + }, + "fieldName": "cpu_load_percent", + "displayName": "cpu_load_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of CPU seconds consumed by processes." + }, + "fieldName": "cpu_time", + "displayName": "cpu_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Percentage of CPU user time consumed by processes." + }, + "fieldName": "cpu_user_percent", + "displayName": "cpu_user_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=cpu" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "facilities" + ] + }, + "objectName": "Facilities", + "displayName": "Facilities", + "parentName": "All_Performance", + "fields": [ + { + "comment": { + "description": "Average temperature of the facilities resource, in degrees Celsius.", + "recommended": true + }, + "fieldName": "temperature", + "displayName": "temperature", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Amount of power consumed by the facilities resource, in Kw\/h." + }, + "fieldName": "power", + "displayName": "power", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The speed of the cooling fan in the facilities resource, in rotations per second." + }, + "fieldName": "fan_speed", + "displayName": "fan_speed", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=facilities" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "memory" + ] + }, + "objectName": "Memory", + "displayName": "Memory", + "parentName": "All_Performance", + "fields": [ + { + "comment": { + "description": "The total amount of memory capacity reported by the resource, in megabytes.", + "recommended": true + }, + "fieldName": "mem", + "displayName": "mem", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The committed amount of memory reported by the resource, in megabytes." + }, + "fieldName": "mem_committed", + "displayName": "mem_committed", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The free amount of memory reported by the resource, in megabytes.", + "recommended": true + }, + "fieldName": "mem_free", + "displayName": "mem_free", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The used amount of memory reported by the resource, in megabytes.", + "recommended": true + }, + "fieldName": "mem_used", + "displayName": "mem_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total swap space size, in megabytes, if applicable." + }, + "fieldName": "swap", + "displayName": "swap", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The free swap space size, in megabytes, if applicable." + }, + "fieldName": "swap_free", + "displayName": "swap_free", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The used swap space size, in megabytes, if applicable." + }, + "fieldName": "swap_used", + "displayName": "swap_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=memory" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "storage" + ] + }, + "objectName": "Storage", + "displayName": "Storage", + "parentName": "All_Performance", + "fields": [ + { + "comment": { + "description": "The array that the resource is a member of, if applicable." + }, + "fieldName": "array", + "displayName": "array", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Block size used by the storage resource, in kilobytes." + }, + "fieldName": "blocksize", + "displayName": "blocksize", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The cluster that the resource is a member of, if applicable." + }, + "fieldName": "cluster", + "displayName": "cluster", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum number of available file descriptors." + }, + "fieldName": "fd_max", + "displayName": "fd_max", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The current number of open file descriptors." + }, + "fieldName": "fd_used", + "displayName": "fd_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The latency reported by the resource, in milliseconds." + }, + "fieldName": "latency", + "displayName": "latency", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The mount point of a storage resource." + }, + "fieldName": "mount", + "displayName": "mount", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A generic indicator of hierarchy. For instance, a disk event might include the array id here." + }, + "fieldName": "parent", + "displayName": "parent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Number of blocks read." + }, + "fieldName": "read_blocks", + "displayName": "read_blocks", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The latency of read operations, in milliseconds." + }, + "fieldName": "read_latency", + "displayName": "read_latency", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Number of read operations." + }, + "fieldName": "read_ops", + "displayName": "read_ops", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total amount of storage capacity reported by the resource, in megabytes." + }, + "fieldName": "storage", + "displayName": "storage", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The free amount of storage capacity reported by the resource, in megabytes.", + "recommended": true + }, + "fieldName": "storage_free", + "displayName": "storage_free", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The percentage of storage capacity reported by the resource that is free.", + "recommended": true + }, + "fieldName": "storage_free_percent", + "displayName": "storage_free_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The used amount of storage capacity reported by the resource, in megabytes.", + "recommended": true + }, + "fieldName": "storage_used", + "displayName": "storage_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The percentage of storage capacity reported by the resource that is used.", + "recommended": true + }, + "fieldName": "storage_used_percent", + "displayName": "storage_used_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of blocks written by the resource." + }, + "fieldName": "write_blocks", + "displayName": "write_blocks", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The latency of write operations, in milliseconds." + }, + "fieldName": "write_latency", + "displayName": "write_latency", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of write operations processed by the resource." + }, + "fieldName": "write_ops", + "displayName": "write_ops", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=storage" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "network" + ] + }, + "objectName": "Network", + "displayName": "Network", + "parentName": "All_Performance", + "fields": [ + { + "comment": { + "description": "The current throughput reported by the service, in bytes.", + "recommended": true + }, + "fieldName": "thruput", + "displayName": "thruput", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum possible throughput reported by the service, in bytes." + }, + "fieldName": "thruput_max", + "displayName": "thruput_max", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=network" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "os" + ] + }, + "objectName": "OS", + "displayName": "OS", + "parentName": "All_Performance", + "fields": [ + { + "comment": { + "description": "The event description signature, if available.", + "recommended": true + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=os" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "os", + "time", + "synchronize" + ] + }, + "objectName": "Timesync", + "displayName": "Time Synchronization", + "parentName": "OS", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Timesync_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The result of a time sync event.", + "expected_values": [ + "success", + "failure" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(action) AND action!=\"\",action,tag=\"success\",\"success\",tag=\"failure\",\"failure\",1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "tag=time tag=synchronize" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "os", + "uptime" + ] + }, + "objectName": "Uptime", + "displayName": "System Uptime", + "parentName": "OS", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Uptime_fillnull_uptime", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The uptime of the compute resource, in seconds.", + "recommended": true + }, + "fieldName": "uptime", + "displayName": "uptime", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(uptime) OR uptime=\"\",\"unknown\",uptime)" + } + ], + "constraints": [ + { + "search": "tag=uptime" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Risk.json b/bin/datamodels/Risk.json new file mode 100644 index 0000000000..306dbcc5e2 --- /dev/null +++ b/bin/datamodels/Risk.json @@ -0,0 +1,563 @@ +{ + "modelName": "Risk", + "displayName": "Risk Analysis", + "description": "Risk Analysis Data Model", + "editable": false, + "comment": { + "ta_relevant": false + }, + "objects": [ + { + "objectName": "All_Risk", + "displayName": "All Risk Modifiers", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "analyticstories", + "displayName": "analyticstories", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations", + "displayName": "annotations", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "annotations._all", + "displayName": "annotations._all", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations._frameworks", + "displayName": "annotations._frameworks", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations.cis20", + "displayName": "annotations.cis20", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations.kill_chain_phases", + "displayName": "annotations.kill_chain_phases", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations.mitre_attack", + "displayName": "annotations.mitre_attack", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations.mitre_attack.mitre_description", + "displayName": "annotations.mitre_attack.mitre_description", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations.mitre_attack.mitre_detection", + "displayName": "annotations.mitre_attack.mitre_detection", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations.mitre_attack.mitre_tactic", + "displayName": "annotations.mitre_attack.mitre_tactic", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations.mitre_attack.mitre_tactic_id", + "displayName": "annotations.mitre_attack.mitre_tactic_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations.mitre_attack.mitre_technique", + "displayName": "annotations.mitre_attack.mitre_technique", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations.mitre_attack.mitre_technique_id", + "displayName": "annotations.mitre_attack.mitre_technique_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations.mitre_attack.mitre_threat_group_name", + "displayName": "annotations.mitre_attack.mitre_threat_group_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "annotations.nist", + "displayName": "annotations.nist", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "control", + "displayName": "control", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "creator", + "displayName": "creator", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons." + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons." + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons." + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "governance", + "displayName": "governance", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the risk_object involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons." + }, + "fieldName": "risk_object_bunit", + "displayName": "risk_object_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the risk_object involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons." + }, + "fieldName": "risk_object_category", + "displayName": "risk_object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the risk_object involved in the event, or who initiated the event. For authentication privilege escalation events, this should represent the user priority targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons." + }, + "fieldName": "risk_object_priority", + "displayName": "risk_object_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "savedsearch_description", + "displayName": "savedsearch_description", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons." + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons." + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons." + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "threat_object", + "displayName": "threat_object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons." + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons." + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons." + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Risk_1description", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "description", + "displayName": "description", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(description),description,isnotnull(savedsearch_description),savedsearch_description,1=1,\"unknown\")" + }, + { + "calculationID": "All_Risk_risk_object", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "risk_object", + "displayName": "risk_object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(risk_object),\"unknown\",risk_object)" + }, + { + "calculationID": "All_Risk_risk_object_type", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "risk_object_type", + "displayName": "risk_object_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(risk_object_type),\"unknown\",risk_object_type)" + }, + { + "calculationID": "All_Risk_risk_score", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "risk_score", + "displayName": "risk_score", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(risk_score),0,risk_score)" + }, + { + "calculationID": "All_Risk_threat_object_type", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "threat_object_type", + "displayName": "threat_object_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(threat_object) AND isnull(threat_object_type),\"unknown\",threat_object_type)" + }, + { + "calculationID": "0_All_Risk_risk_factor_add", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "risk_factor_add", + "displayName": "risk_factor_add", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "0" + }, + { + "calculationID": "1_All_Risk_risk_factor_add_matched", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "risk_factor_add_matched", + "displayName": "risk_factor_add_matched", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "null" + }, + { + "calculationID": "2_All_Risk_risk_factor_mult", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "risk_factor_mult", + "displayName": "risk_factor_mult", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "1" + }, + { + "calculationID": "3_All_Risk_risk_factor_mult_matched", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "risk_factor_mult_matched", + "displayName": "risk_factor_mult_matched", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "null" + }, + { + "calculationID": "4_All_Risk_calculated_risk_score", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "calculated_risk_score", + "displayName": "calculated_risk_score", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "(risk_score + risk_factor_add) * risk_factor_mult" + }, + { + "calculationID": "5_All_Risk_risk_message", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "risk_message", + "displayName": "risk_message", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "case(isnotnull(risk_message),risk_message,isnotnull(description),description,isnotnull(savedsearch_description),savedsearch_description,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "index=risk | eval tag=mvdedup(mvappend(tag,NULL,orig_tag)), governance_lookup_type=\"default\" | lookup governance_lookup savedsearch as source, lookup_type as governance_lookup_type OUTPUT governance, control | eval governance_lookup_type=\"tag\" | lookup governance_lookup savedsearch as source, tag, lookup_type as governance_lookup_type OUTPUT governance as governance_tag, control as control_tag | eval \"governance\"=mvappend('governance',NULL,'governance_tag'),\"control\"=mvappend('control',NULL,'control_tag') | fields - governance_lookup_type,governance_tag,control_tag", + "children": [ + + ] + } + ] +} diff --git a/bin/datamodels/Splunk_Audit.json b/bin/datamodels/Splunk_Audit.json new file mode 100644 index 0000000000..2b85da7d57 --- /dev/null +++ b/bin/datamodels/Splunk_Audit.json @@ -0,0 +1,1303 @@ +{ + "modelName": "Splunk_Audit", + "displayName": "Splunk Audit Logs", + "description": "Splunk Audit Logs Data Model", + "editable": false, + "objects": [ + { + "objectName": "Datamodel_Acceleration", + "displayName": "Data Model Acceleration", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The number of times the data model summary has been accessed since it was created.", + "ta_relevant": false + }, + "fieldName": "access_count", + "displayName": "access_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The timestamp of the most recent access of the data model summary.", + "ta_relevant": false + }, + "fieldName": "access_time", + "displayName": "access_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The application context in which the data model summary was accessed.", + "ta_relevant": false + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of index buckets spanned by the data model acceleration summary.", + "ta_relevant": false + }, + "fieldName": "buckets", + "displayName": "buckets", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total size of the buckets spanned by the data model acceleration summary.", + "ta_relevant": false + }, + "fieldName": "buckets_size", + "displayName": "buckets_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The cron expression used to accelerate the data model.", + "ta_relevant": false + }, + "fieldName": "cron", + "displayName": "cron", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The percentage of the data model summary that is currently complete.", + "ta_relevant": false + }, + "fieldName": "complete", + "displayName": "complete", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the data model accelerated.", + "ta_relevant": false + }, + "fieldName": "datamodel", + "displayName": "datamodel", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A hash of the current data model contents.", + "ta_relevant": false + }, + "fieldName": "digest", + "displayName": "digest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The earliest time that the data model summary was accessed.", + "ta_relevant": false + }, + "fieldName": "earliest", + "displayName": "earliest", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Indicates whether the data model acceleration is currently in progress.", + "expected_values": [ + "true", + "false", + "1", + "0" + ], + "ta_relevant": false + }, + "fieldName": "is_inprogress", + "displayName": "is_inprogress", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The text of the last error reported during the data model acceleration.", + "ta_relevant": false + }, + "fieldName": "last_error", + "displayName": "last_error", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The search id of the last acceleration attempt.", + "ta_relevant": false + }, + "fieldName": "last_sid", + "displayName": "last_sid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The most recent acceleration timestamp of the data model.", + "ta_relevant": false + }, + "fieldName": "latest", + "displayName": "latest", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The timestamp of the most recent modification to the data model acceleration.", + "ta_relevant": false + }, + "fieldName": "mod_time", + "displayName": "mod_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The length of time that data model accelerations are retained, in seconds.", + "ta_relevant": false + }, + "fieldName": "retention", + "displayName": "retention", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of storage space the data model's acceleration summary takes up, in bytes.", + "ta_relevant": false + }, + "fieldName": "size", + "displayName": "size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique id of the data model acceleration summary.", + "ta_relevant": false + }, + "fieldName": "summary_id", + "displayName": "summary_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + + ], + "baseSearch": "| `cim_datamodelinfo`", + "children": [ + + ] + }, + { + "comment": { + "ta_relevant": false + }, + "objectName": "Search_Activity", + "displayName": "Search Activity", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The action of the search (granted, completed, cancelled, failed)." + }, + "fieldName": "info", + "displayName": "info", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The earliest time of the search." + }, + "fieldName": "search_et", + "displayName": "search_et", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The latest time of the search." + }, + "fieldName": "search_lt", + "displayName": "search_lt", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total run time of the search." + }, + "fieldName": "total_run_time", + "displayName": "total_run_time", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "0Search_Activity_user", + "calculationType": "Rex", + "inputField": "_raw", + "outputFields": [ + { + "comment": { + "description": "The name of the user who ran the search." + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "user=(?[^,]+), action" + }, + { + "calculationID": "1Search_Activity_datamodel", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the datamodel (for datamodel acceleration searches)." + }, + "fieldName": "datamodel", + "displayName": "datamodel", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(match(savedsearch_name, \"_ACCELERATE_DM_.*\"), replace(savedsearch_name, \"_ACCELERATE_DM_(.*)_ACCELERATE_\", \"\\1\"), match(search, \"'?(\\|\\s+)?summarize.*?id=DM_\"), replace(search, \"'?(?:\\|\\s)?summarize.*?id=DM_([^\\s]+).*\", \"\\1\"), 1=1, null())" + }, + { + "calculationID": "2Search_Activity_search_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The ID of the search." + }, + "fieldName": "search_id", + "displayName": "search_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "trim(search_id, \"'\")" + }, + { + "calculationID": "3Search_Activity_savedsearch_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the saved search." + }, + "fieldName": "savedsearch_name", + "displayName": "savedsearch_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(savedsearch_name=\"\",null(),savedsearch_name)" + }, + { + "calculationID": "4Search_Activity_search", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The SPL search syntax." + }, + "fieldName": "search", + "displayName": "search", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(search) OR search=\"\",null(),search)" + }, + { + "calculationID": "5Search_Activity_search_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The type of search." + }, + "fieldName": "search_type", + "displayName": "search_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(search_type) AND NOT search_type LIKE \"case(%\",search_type,savedsearch_name LIKE \"_ACCELERATE_DM%\", \"dm_acceleration\", search_id LIKE \"scheduler%\", \"scheduled\", search_id LIKE \"rt%\", \"realtime\", search_id LIKE \"subsearch%\", \"subsearch\", (search_id LIKE \"SummaryDirector%\" OR search_id LIKE \"summarize_SummaryDirector%\"), \"summary_director\", 1=1, \"adhoc\")" + }, + { + "calculationID": "6Search_Activity_search_alias", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Short description of the type of search being run, such as the name of the search or the name of the data model being accelerated." + }, + "fieldName": "search_alias", + "displayName": "search_alias", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(datamodel) AND search_id LIKE \"SummaryDirector%\",datamodel.\" Data Model Summary Director\",isnotnull(datamodel),datamodel.\" Data Model Acceleration\",isnotnull(savedsearch_name),savedsearch_name,1=1,null())" + } + ], + "constraints": [ + { + "search": "index=_audit action=search search_id=*" + } + ], + "children": [ + + ] + }, + { + "objectName": "Acceleration_Jobs", + "displayName": "Acceleration Jobs", + "parentName": "Search_Activity", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "search_type=\"dm_acceleration\" OR search_type=\"summary_director\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Adhoc_Jobs", + "displayName": "Adhoc Jobs", + "parentName": "Search_Activity", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "search_type=\"adhoc\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Failed_Jobs", + "displayName": "Failed Jobs", + "parentName": "Search_Activity", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "info=\"failed\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Realtime_Jobs", + "displayName": "Real-time Jobs", + "parentName": "Search_Activity", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "search_type=\"realtime\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Scheduled_Jobs", + "displayName": "Scheduled Jobs", + "parentName": "Search_Activity", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "search_type=\"scheduled\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Subsearch_Jobs", + "displayName": "Subsearch Jobs", + "parentName": "Search_Activity", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "search_type=\"subsearch\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Scheduler_Activity", + "displayName": "Scheduler Activity", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The event timestamp expressed in Unix time.", + "ta_relevant": false + }, + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The app context in which the scheduled search was run.", + "ta_relevant": false + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The host on which the scheduled search was run.", + "ta_relevant": false + }, + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the saved search.", + "ta_relevant": false + }, + "fieldName": "savedsearch_name", + "displayName": "savedsearch_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The search id.", + "ta_relevant": false + }, + "fieldName": "sid", + "displayName": "sid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source associated with the scheduled search.", + "ta_relevant": false + }, + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source type associated with the scheduled search.", + "ta_relevant": false + }, + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The Splunk Server on which the scheduled search runs.", + "ta_relevant": false + }, + "fieldName": "splunk_server", + "displayName": "splunk_server", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status of the scheduled search.", + "ta_relevant": false + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The user who scheduled the search.", + "ta_relevant": false + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + + ], + "baseSearch": "index=_internal sourcetype=scheduler", + "children": [ + + ] + }, + { + "objectName": "View_Activity", + "displayName": "View Activity", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The app name which contains the view.", + "ta_relevant": false + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": true, + "multivalue": false, + "hidden": false + }, { + "comment": { + "description": "The amount of time spent loading the view (in milliseconds).", + "ta_relevant": false + }, + "fieldName": "spent", + "displayName": "spent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The uniform resource identifier of the view activity.", + "ta_relevant": false + }, + "fieldName": "uri", + "displayName": "uri", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The username of the user who accessed the view.", + "ta_relevant": false + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the view.", + "ta_relevant": false + }, + "fieldName": "view", + "displayName": "view", + "type": "string", + "fieldSearch": "", + "required": true, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "index=_internal sourcetype=splunk_web_access method=GET status=200" + } + ], + "children": [ + + ] + }, + { + "objectName": "Web_Service_Errors", + "displayName": "Web Service Errors", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The event timestamp expressed in Unix time.", + "ta_relevant": false + }, + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The host on which the web service error occurred.", + "ta_relevant": false + }, + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source where the web service error occurred.", + "ta_relevant": false + }, + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source type associated with the web service error.", + "ta_relevant": false + }, + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + + ], + "baseSearch": "index=_internal sourcetype=splunk_web_service tag=error", + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "modaction" + ] + }, + "objectName": "Modular_Actions", + "displayName": "Modular Actions", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The app ID of the app or add-on that owns the action.", + "ta_relevant": false + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Specifies whether the action was executed as an ad hoc action or from a saved search, based on whether a search_name exists.", + "expected_values": [ + "saved", + "adhoc" + ], + "ta_relevant": false + }, + "fieldName": "action_mode", + "displayName": "action_mode", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status of the action. For example, 'success' or 'failure'.", + "ta_relevant": false + }, + "fieldName": "action_status", + "displayName": "action_status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The component of the modular action script involved in the event. Often used in conjunction with duration.", + "ta_relevant": false + }, + "fieldName": "component", + "displayName": "component", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "How long the action took to complete, in milliseconds.", + "ta_relevant": false + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The id associated with the result of a specific sid. By default, this is the row number of the search, starting with 0.", + "ta_relevant": false + }, + "fieldName": "rid", + "displayName": "rid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The original sid value of a source action, automatically added to an event if it is the product of a previously executed action.", + "ta_relevant": false + }, + "fieldName": "orig_sid", + "displayName": "orig_sid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The rid value of a source action result, automatically added to an event if it is the product of a previously executed action.", + "ta_relevant": false + }, + "fieldName": "orig_rid", + "displayName": "orig_rid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the correlation search that triggered the action. Blank for ad hoc actions.", + "ta_relevant": false + }, + "fieldName": "search_name", + "displayName": "search_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Modular_Actions_fillnull_action_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the action.", + "ta_relevant": false + }, + "fieldName": "action_name", + "displayName": "action_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(action_name) AND action_name!=\"\",action_name,sourcetype=\"splunkd\" AND isnotnull(action) AND action!=\"\",action,1=1,\"unknown\")" + }, + { + "calculationID": "Modular_Actions_fillnull_signature", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The logging string associated with alert action introspection events.", + "ta_relevant": false + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)" + }, + { + "calculationID": "Modular_Actions_fillnull_sid", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The search id, automatically assigned by splunkd.", + "ta_relevant": false + }, + "fieldName": "sid", + "displayName": "sid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(sid) OR sid=\"\",\"unknown\",sid)" + }, + { + "calculationID": "Modular_Actions_user_or_owner", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user who triggered an ad hoc alert. Not relevant for actions triggered by searches.", + "ta_relevant": false + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(user) AND user!=\"\",user,owner)" + }, + { + "calculationID": "Modular_Actions_worker", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The worker performing the action.", + "ta_relevant": false + }, + "fieldName": "worker", + "displayName": "worker", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(worker) AND worker!=\"\",\"unknown\",worker)" + } + ], + "constraints": [ + { + "search": "tag=modaction" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "modaction", + "invocation" + ] + }, + "objectName": "Modular_Action_Invocations", + "displayName": "Modular Action Invocations", + "parentName": "Modular_Actions", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=invocation" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Splunk_CIM_Validation.json b/bin/datamodels/Splunk_CIM_Validation.json new file mode 100644 index 0000000000..c7ca2649e2 --- /dev/null +++ b/bin/datamodels/Splunk_CIM_Validation.json @@ -0,0 +1,3648 @@ +{ + "modelName": "Splunk_CIM_Validation", + "displayName": "CIM Validation (S.o.S.)", + "description": "This data model is to help check adoption into the CIM. It provides useful objects for making sure things are tagged appropriately and verify key fields for the different models are not missing.", + "editable": false, + "objects": [ + { + "objectName": "Alerts", + "displayName": "Alerts", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Alerts Alerts search", + "children": [ + + ] + }, + { + "objectName": "Application_State", + "displayName": "Application State", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Application_State All_Application_State search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Ports", + "displayName": "Missing Extractions - Ports", + "parentName": "Application_State", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Application_State.is_Ports=1 AND (dest=\"unknown\" OR dest_port=0 OR transport=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Processes", + "displayName": "Missing Extractions - Processes", + "parentName": "Application_State", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "process", + "displayName": "process", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Application_State.is_Processes=1 AND (dest=\"unknown\" OR process=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Services", + "displayName": "Missing Extractions - Services", + "parentName": "Application_State", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "service", + "displayName": "service", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "start_mode", + "displayName": "start_mode", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Application_State.is_Services=1 AND (dest=\"unknown\" OR service=\"unknown\" OR start_mode=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Authentication", + "displayName": "Authentication", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Authentication Authentication search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Authentication", + "displayName": "Missing Extractions Authentication", + "parentName": "Authentication", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(action=\"unknown\" OR app=\"unknown\" OR src=\"unknown\" OR dest=\"unknown\" OR user=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Certificates", + "displayName": "Certificates", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Certificates All_Certificates search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Certificates", + "displayName": "Missing Extractions Certificates", + "parentName": "Certificates", + "fields": [ + { + "fieldName": "ssl_hash", + "displayName": "ssl_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "ssl_issuer", + "displayName": "ssl_issuer", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "ssl_subject", + "displayName": "ssl_subject", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "ssl_hash=\"unknown\" OR ssl_issuer=\"unknown\" OR ssl_subject=\"unknown\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Change_Analysis", + "displayName": "Change Analysis", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Change_Analysis All_Changes search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Account_Management", + "displayName": "Missing Extractions - Account Management", + "parentName": "Change_Analysis", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "command", + "displayName": "command", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Changes.is_Account_Management=1 AND (action=\"unknown\" OR command=\"unknown\" OR dest=\"unknown\" OR object_category=\"unknown\" OR src=\"unknown\" OR user=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Endpoint_Changes", + "displayName": "Missing Extractions - Endpoint Changes", + "parentName": "Change_Analysis", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object_path", + "displayName": "object_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Changes.is_Endpoint_Changes=1 AND (action=\"unknown\" OR dest=\"unknown\" OR object=\"unknown\" OR object_category=\"unknown\" OR object_path=\"unknown\" OR status=\"unknown\" OR user=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Filesystem_Changes", + "displayName": "Missing Extractions - Filesystem Changes", + "parentName": "Change_Analysis", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object_path", + "displayName": "object_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_access_time", + "displayName": "file_access_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_create_time", + "displayName": "file_create_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_hash", + "displayName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_modify_time", + "displayName": "file_modify_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_name", + "displayName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_path", + "displayName": "file_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_acl", + "displayName": "file_acl", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_size", + "displayName": "file_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Changes.is_Endpoint_Changes=1 AND (object_category=file OR object_category=directory) AND (action=\"unknown\" OR dest=\"unknown\" OR object=\"unknown\" OR object_category=\"unknown\" OR object_path=\"unknown\" OR status=\"unknown\" OR user=\"unknown\" OR file_access_time=0 OR file_create_time=0 OR file_hash=\"unknown\" OR file_modify_time=0 OR file_name=\"unknown\" OR file_path=\"unknown\" OR file_acl=\"unknown\" OR file_size=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Network_Changes", + "displayName": "Missing Extractions - Network Changes", + "parentName": "Change_Analysis", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "command", + "displayName": "command", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Changes.is_Network_Changes=1 AND (action=\"unknown\" OR command=\"unknown\" OR dvc=\"unknown\" OR user=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Restarts", + "displayName": "Missing Extractions - Restarts", + "parentName": "Change_Analysis", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "command", + "displayName": "command", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Changes.is_Network_Changes=1 AND (action=\"unknown\" OR change_type=\"unknown\") AND (reboot* OR restart*) sourcetype!=stash" + } + ], + "children": [ + + ] + }, + { + "objectName": "Compute_Inventory", + "displayName": "Inventory", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Compute_Inventory All_Inventory search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_CPU", + "displayName": "Missing Extractions - CPU", + "parentName": "Compute_Inventory", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_cores", + "displayName": "cpu_cores", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_count", + "displayName": "cpu_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_mhz", + "displayName": "cpu_mhz", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Inventory.is_CPU=1 AND (dest=\"unknown\" OR NOT (cpu_cores=* OR cpu_count=* OR cpu_mhz=*))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Memory", + "displayName": "Missing Extractions - Memory", + "parentName": "Compute_Inventory", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mem", + "displayName": "mem", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Inventory.is_Memory=1 AND (dest=\"unknown\" OR NOT (mem=*))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Network", + "displayName": "Missing Extractions - Network", + "parentName": "Compute_Inventory", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "interface", + "displayName": "interface", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "ip", + "displayName": "ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mac", + "displayName": "mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "name", + "displayName": "name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dns", + "displayName": "dns", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Inventory.is_Network=1 AND (dest=\"unknown\" OR NOT (interface=* OR ip=* OR mac=* OR name=* OR dns=*))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Storage", + "displayName": "Missing Extractions - Storage", + "parentName": "Compute_Inventory", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mount", + "displayName": "mount", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "storage", + "displayName": "storage", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Inventory.is_Storage=1 AND (dest=\"unknown\" OR NOT (mount=* OR storage=*))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_OS", + "displayName": "Missing Extractions - OS", + "parentName": "Compute_Inventory", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "os", + "displayName": "os", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "version", + "displayName": "version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Inventory.is_OS=1 AND (dest=\"unknown\" OR NOT (os=* OR version=*))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Databases", + "displayName": "Databases", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Databases All_Databases search", + "children": [ + + ] + }, + { + "objectName": "Email", + "displayName": "Email", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Email All_Email search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_All_Email", + "displayName": "Missing Extractions - All Email", + "parentName": "Email", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(action=\"unknown\" OR dest=\"unknown\" OR src=\"unknown\" OR src_user=\"unknown\" OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Interprocess_Messaging", + "displayName": "Interprocess Messaging", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Interprocess_Messaging All_Messaging search", + "children": [ + + ] + }, + { + "objectName": "Intrusion_Detection", + "displayName": "Intrusion Detection", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Intrusion_Detection IDS_Attacks search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_IDS", + "displayName": "Missing Extractions - IDS", + "parentName": "Intrusion_Detection", + "fields": [ + { + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "ids_type", + "displayName": "ids_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(dvc=\"unknown\" OR ids_type=\"unknown\" OR category=\"unknown\" OR signature=\"unknown\" OR severity=\"unknown\" OR src=\"unknown\" OR dest=\"unknown\" OR user=\"unknown\" OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "JVM", + "displayName": "JVM", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel JVM JVM search", + "children": [ + + ] + }, + { + "objectName": "Malware", + "displayName": "Malware", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Malware Malware_Attacks search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Malware_Attacks", + "displayName": "Missing Extractions - Malware Attacks", + "parentName": "Malware", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(action=\"unknown\" OR category=\"unknown\" OR signature=\"unknown\" OR dest=\"unknown\" OR dest_nt_domain=\"unknown\" OR user=\"unknown\" OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Malware_Operations", + "displayName": "Missing Extractions - Malware Operations", + "parentName": "Malware", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor", + "displayName": "vendor", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "product", + "displayName": "product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "dest=\"unknown\" OR dest_nt_domain=\"unknown\" OR product=\"unknown\" OR (NOT (product_version=* OR signature_version=*)) OR vendor=\"unknown\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Network_Resolution", + "displayName": "Network Resolution", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Network_Resolution DNS search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_DNS", + "displayName": "Missing Extractions - DNS", + "parentName": "Network_Resolution", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "answer", + "displayName": "answer", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "query", + "displayName": "query", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "message_type", + "displayName": "message_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "reply_code", + "displayName": "reply_code", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "src=\"unknown\" OR dest=\"unknown\" OR answer=\"unknown\" OR query=\"unknown\" OR message_type=\"unknown\" OR reply_code=\"unknown\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Network_Sessions", + "displayName": "Network Sessions", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Network_Sessions All_Sessions search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Network_Sessions", + "displayName": "Missing Extractions - Network Sessions", + "parentName": "Network_Sessions", + "fields": [ + { + "fieldName": "dest_ip", + "displayName": "dest_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(dest_ip=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Network_Traffic", + "displayName": "Network Traffic", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Network_Traffic All_Traffic search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Network_Traffic", + "displayName": "Missing Extractions - Network Traffic", + "parentName": "Network_Traffic", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "rule", + "displayName": "rule", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src_port", + "displayName": "src_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(action=\"unknown\" OR dvc=\"unknown\" OR rule=\"unknown\" OR transport=\"unknown\" OR src=\"unknown\" OR src_port=0 OR dest=\"unknown\" OR dest_port=0 OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Performance", + "displayName": "Performance", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Performance All_Performance search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_CPU", + "displayName": "Missing Extractions - CPU", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_load_mhz", + "displayName": "cpu_load_mhz", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_load_percent", + "displayName": "cpu_load_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_time", + "displayName": "cpu_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_user_percent", + "displayName": "cpu_user_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_CPU=1 AND ((dest=\"unknown\" OR NOT (cpu_load_mhz=* OR cpu_load_percent=* OR cpu_time=* OR cpu_user_percent=*)))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_Facilities", + "displayName": "Missing Extractions - Facilities", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "temperature", + "displayName": "temperature", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "power", + "displayName": "power", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "fan_speed", + "displayName": "fan_speed", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_Facilities=1 AND ((dest=\"unknown\" OR NOT (temperature=* OR power=* OR fan_speed=*)))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_Memory", + "displayName": "Missing Extractions - Memory", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mem", + "displayName": "mem", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mem_free", + "displayName": "mem_free", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mem_used", + "displayName": "mem_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_Memory=1 AND ((dest=\"unknown\" OR NOT (mem=* OR mem_committed=* OR mem_free=* OR mem_used=*)))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_Storage", + "displayName": "Missing Extractions - Storage", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mount", + "displayName": "mount", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "storage", + "displayName": "storage", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "storage_free", + "displayName": "storage_free", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "storage_used", + "displayName": "storage_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "storage_free_percent", + "displayName": "storage_free_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "storage_used_percent", + "displayName": "storage_used_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_Storage=1 AND ((dest=\"unknown\" OR NOT (mount=* OR storage=* OR storage_free=* OR storage_used=* OR storage_free_percent=* OR storage_used_percent=*)))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_Network", + "displayName": "Missing Extractions - Network", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "thruput", + "displayName": "thruput", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "thruput_max", + "displayName": "thruput_max", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_Network=1 AND ((dest=\"unknown\" OR NOT (thruput=* OR thruput_max=*)))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_Timesync", + "displayName": "Missing Time Synchronization Extractions", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_OS=1 AND (tag=time tag=synchronize (dest=\"unknown\" OR action=\"unknown\"))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_Uptime", + "displayName": "Missing Extractions - Uptime", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_OS=1 AND (tag=uptime (dest=\"unknown\" OR uptime=\"unknown\"))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Splunk_Audit", + "displayName": "Splunk Audit", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Splunk_Audit View_Activity search", + "children": [ + + ] + }, + { + "objectName": "Ticket_Management", + "displayName": "Ticket Management", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Ticket_Management All_Ticket_Management search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_All_Ticket_Managment", + "displayName": "Missing Extractions - All Ticket Management", + "parentName": "Ticket_Management", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "ticket_id", + "displayName": "ticket_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "dest=\"unknown\" OR ticket_id=\"unknown\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Incident", + "displayName": "Missing Extractions - Incident", + "parentName": "Ticket_Management", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "incident", + "displayName": "incident", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Ticket_Management.is_Incident=1 AND (dest=\"unknown\" OR incident=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Problem", + "displayName": "Missing Extractions - Problem", + "parentName": "Ticket_Management", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "problem", + "displayName": "problem", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Ticket_Management.is_Problem=1 AND (dest=\"unknown\" OR problem=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Change", + "displayName": "Missing Extractions - Change(S.o.S)", + "parentName": "Ticket_Management", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "change", + "displayName": "change", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Ticket_Management.is_Change=1 AND (dest=\"unknown\" OR NOT change=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Updates", + "displayName": "Updates", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Updates Updates search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Updates", + "displayName": "Missing Extractions", + "parentName": "Updates", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(dest=\"unknown\" OR signature=\"unknown\" OR signature_id=\"unknown\" OR status=\"unknown\" OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Vulnerabilities", + "displayName": "Vulnerabilities", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Vulnerabilities Vulnerabilities search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Vulnerabilities", + "displayName": "Missing Extractions - Vulnerabilities", + "parentName": "Vulnerabilities", + "fields": [ + { + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(dvc=\"unknown\" OR category=\"unknown\" OR signature=\"unknown\" OR severity=\"unknown\" OR dest=\"unknown\" OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Web", + "displayName": "Web", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Web Web search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Web", + "displayName": "Missing Extractions - Web", + "parentName": "Web", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "http_content_type", + "displayName": "http_content_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "http_method", + "displayName": "http_method", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "http_referrer", + "displayName": "http_referrer", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "http_user_agent", + "displayName": "http_user_agent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "url", + "displayName": "url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(action=\"unknown\" OR dest=\"unknown\" OR http_content_type=\"unknown\" OR http_method=\"unknown\" OR http_referrer=\"unknown\" OR http_user_agent=\"unknown\" OR src=\"unknown\" OR status=\"unknown\" OR url=\"unknown\" OR user=\"unknown\" OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Events", + "displayName": "Untagged Events", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "*", + "children": [ + + ] + }, + { + "objectName": "Untagged_Ports", + "displayName": "Untagged Port Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(listen OR listening OR open) (port OR ports) sourcetype!=stash NOT (tag=listening tag=port)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Processes", + "displayName": "Untagged Process Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(process) sourcetype!=stash NOT (tag=process tag=report)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Services", + "displayName": "Untagged Service Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(running OR stopped OR runlevel* OR service) sourcetype!=stash NOT (tag=service tag=report)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Authentication", + "displayName": "Untagged Authentication", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(login OR \"log in\" OR authenticated) sourcetype!=stash NOT tag=authentication" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Changes", + "displayName": "Untagged Changes", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(change OR changed OR modify OR modified OR restart* OR reboot*) sourcetype!=stash NOT tag=change" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Email", + "displayName": "Untagged Email", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(postfix OR sendmail OR rcpts OR nrcpts OR recipients OR msgid OR message-id) sourcetype!=stash NOT tag=email" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_IDS", + "displayName": "Untagged Intrusion Detection", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(sourcetype=*idp* OR sourcetype=*ids* OR intrusion OR hip) sourcetype!=stash NOT (tag=ids tag=attack)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Malware_Attacks", + "displayName": "Untagged Malware Attacks", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(virus OR malware OR infection OR infected) sourcetype!=stash NOT (tag=malware tag=attack)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Network_Resolution", + "displayName": "Untagged Network Resolution", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(BIND) sourcetype!=stash NOT (tag=network tag=resolution)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Network_Sessions", + "displayName": "Untagged Network Sessions", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(*dhcp* OR *vpn) sourcetype!=stash NOT (tag=network tag=session)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Network_Traffic", + "displayName": "Untagged Network Traffic", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(accept OR drop) sourcetype!=stash NOT (tag=network tag=communicate)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Perf_CPU", + "displayName": "Untagged CPU Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(cpu OR cputime OR mhz OR ghz) sourcetype!=stash NOT (tag=performance tag=cpu)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Facilities", + "displayName": "Untagged Facilities Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(power OR temperature) sourcetype!=stash NOT (tag=performance tag=facilities)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Memory", + "displayName": "Untagged Process Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(mem OR memory) sourcetype!=stash NOT (tag=performance tag=memory)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Storage", + "displayName": "Untagged Storage Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(mount OR disk OR df) sourcetype!=stash NOT (tag=performance tag=storage)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Network", + "displayName": "Untagged Network Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(net OR network) sourcetype!=stash NOT (tag=performance tag=network)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_OS", + "displayName": "Untagged OS Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "sourcetype!=stash (((uptime OR systemuptime) NOT (tag=performance tag=os tag=uptime)) OR (time sync* NOT (tag=performance tag=os tag=time tag=synchronize)))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Updates", + "displayName": "Untagged Updates", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(update OR updates OR installed OR \"restart required\" OR available OR patch) sourcetype!=stash NOT (tag=update tag=status)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Vulnerabilities", + "displayName": "Untagged Vulnerabilities", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(sourcetype=*vuln* OR \"vulnerability detected\" OR CVE) sourcetype!=stash NOT (tag=vulnerability tag=report)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Web", + "displayName": "Untagged Web Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "http sourcetype!=stash NOT (tag=web)" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Ticket_Management.json b/bin/datamodels/Ticket_Management.json new file mode 100644 index 0000000000..775aaa4c0d --- /dev/null +++ b/bin/datamodels/Ticket_Management.json @@ -0,0 +1,462 @@ +{ + "modelName": "Ticket_Management", + "displayName": "Ticket Management", + "description": "Ticket Management Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "ticketing" + ] + }, + "objectName": "All_Ticket_Management", + "displayName": "All Ticket Management", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "Destinations affected by the service request." + }, + "fieldName": "affect_dest", + "displayName": "affect_dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "Comments about the service request." + }, + "fieldName": "comments", + "displayName": "comments", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The description of the service request." + }, + "fieldName": "description", + "displayName": "description", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The relative priority of the service request." + }, + "fieldName": "priority", + "displayName": "priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The relative severity of the service request." + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier of the service request as it pertains to Splunk. For example, 14DA67E8-6084-4FA8-9568-48D05969C522@@_internal@@0533eff241db0d892509be46cd3126e30e0f6046." + }, + "fieldName": "splunk_id", + "displayName": "splunk_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The Splunk application or use case associated with the unique identifier (splunk_id). For example, es_notable." + }, + "fieldName": "splunk_realm", + "displayName": "splunk_realm", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The user or entity that created or triggered the service request, if applicable." + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit associated with the user or entity that triggered the service request.", + "ta_relevant": false + }, + "fieldName": "src_user_bunit", + "displayName": "src_user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category associated with the user or entity that triggered the service request.", + "ta_relevant": false + }, + "fieldName": "src_user_category", + "displayName": "src_user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority associated with the user or entity that triggered the service request.", + "ta_relevant": false + }, + "fieldName": "src_user_priority", + "displayName": "src_user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The relative status of the service request." + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The time that the src_user submitted the service request." + }, + "fieldName": "time_submitted", + "displayName": "time_submitted", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the user or entity that is assigned to carry out the service request, if applicable." + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit associated with the user or entity that is assigned to carry out the service request, if applicable.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category associated with the user or entity that is assigned to carry out the service request, if applicable.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user or entity that is assigned to carry out the service request, if applicable.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Ticket_Management_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination of the service request. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name." + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "All_Ticket_Management_fillnull_ticket_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "An identification name, code, or number for the service request." + }, + "fieldName": "ticket_id", + "displayName": "ticket_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(ticket_id) OR ticket_id=\"\",\"unknown\",ticket_id)" + } + ], + "constraints": [ + { + "search": "(`cim_Ticket_Management_indexes`) tag=ticketing" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "ticketing", + "change" + ] + }, + "objectName": "Change", + "displayName": "Change", + "parentName": "All_Ticket_Management", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Change_fillnull_change", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Designation for a request for change (RFC) that is raised to modify an IT service to resolve an incident or problem." + }, + "fieldName": "change", + "displayName": "change", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(change) OR change=\"\",\"unknown\",change)" + } + ], + "constraints": [ + { + "search": "tag=change" + } + ] + }, + { + "comment": { + "tags": [ + "ticketing", + "incident" + ] + }, + "objectName": "Incident", + "displayName": "Incident", + "parentName": "All_Ticket_Management", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Incident_fillnull_incident", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The incident that triggered the service request. Can be a rare occurrence, or something that happens more frequently An incident that occurs on a frequent basis can also be classified as a problem." + }, + "fieldName": "incident", + "displayName": "incident", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(incident) OR incident=\"\",\"unknown\",incident)" + } + ], + "constraints": [ + { + "search": "tag=incident" + } + ] + }, + { + "comment": { + "tags": [ + "ticketing", + "problem" + ] + }, + "objectName": "Problem", + "displayName": "Problem", + "parentName": "All_Ticket_Management", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Problem_fillnull_problem", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "When multiple occurrences of related incidents are observed, they are collectively designated with a single problem value. Problem management differs from the process of managing an isolated incident. Often problems are managed by a specific set of staff and through a problem management process." + }, + "fieldName": "problem", + "displayName": "problem", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(problem) OR problem=\"\",\"unknown\",problem)" + } + ], + "constraints": [ + { + "search": "tag=problem" + } + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/UEBA.json b/bin/datamodels/UEBA.json new file mode 100644 index 0000000000..fd9599d566 --- /dev/null +++ b/bin/datamodels/UEBA.json @@ -0,0 +1,290 @@ +{ + "modelName": "UEBA", + "displayName": "User and Entity Behavior Analytics", + "description": "User and Entity Behavior Analytics Data Model", + "editable": false, + "objects": [ + { + "objectName": "All_UEBA_Events", + "displayName": "All UEBA Events", + "parentName": "BaseEvent", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "uba_event_id", + "displayName": "uba_event_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "uba_event_type", + "displayName": "uba_event_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "description", + "displayName": "description", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "link", + "displayName": "link", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "threat_category", + "displayName": "threat_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "url", + "displayName": "url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "fieldName": "uba_host", + "displayName": "uba_host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_UEBA_Events_uba_time", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "uba_time", + "displayName": "uba_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "strptime(uba_time, \"%Y-%m-%d %H:%M:%S %Z\")" + }, + { + "calculationID": "All_UEBA_Events_modify_time", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "modify_time", + "displayName": "modify_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "strptime(modify_time, \"%Y-%m-%d %H:%M:%S %Z\")" + }, + { + "calculationID": "All_UEBA_Events_start_time", + "calculationType": "Eval", + "outputFields": [ + { + "fieldName": "start_time", + "displayName": "start_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "strptime(start_time, \"%Y-%m-%d %H:%M:%S %Z\")" + } + ], + "constraints": [ + { + "search": "index=ueba (sourcetype=ueba OR sourcetype=uba_threat_json)" + } + ], + "children": [ + + ] + }, + { + "objectName": "UEBA_Threats", + "displayName": "UEBA Threats", + "parentName": "All_UEBA_Events", + "fields": [ + { + "fieldName": "uba_threat_status", + "displayName": "uba_threat_status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "uba_event_type=threat" + } + ], + "children": [ + + ] + }, + { + "objectName": "New_UEBA_Threats", + "displayName": "New UEBA Threats", + "parentName": "UEBA_Threats", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "change_type=new" + } + ], + "children": [ + + ] + }, + { + "objectName": "UEBA_Anomalies", + "displayName": "UEBA Anomalies", + "parentName": "All_UEBA_Events", + "fields": [ + { + "fieldName": "uba_model", + "displayName": "uba_model", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "uba_model_version", + "displayName": "uba_model_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "uba_event_type=anomaly" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Updates.json b/bin/datamodels/Updates.json new file mode 100644 index 0000000000..e304a78a50 --- /dev/null +++ b/bin/datamodels/Updates.json @@ -0,0 +1,419 @@ +{ + "modelName": "Updates", + "displayName": "Updates", + "description": "Updates Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "update", + "status" + ] + }, + "objectName": "Updates", + "displayName": "Updates", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The device that detected the patch event, such as a patching or configuration management server. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name." + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the patch package that was installed or attempted." + }, + "fieldName": "file_name", + "displayName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The checksum of the patch package that was installed or attempted." + }, + "fieldName": "file_hash", + "displayName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The severity associated with the patch event.", + "expected_values": [ + "critical", + "high", + "medium", + "low", + "informational" + ] + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Updates_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system that is affected by the patch change. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Updates_fillnull_signature", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the patch requirement detected on the client (the dest), such as MS08-067 or RHBA-2013:0739. Note: This is a string value. Use signature_id for numeric or non-human-readable indicators.", + "recommended": true + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "case(isnotnull(signature) AND signature!=\"\",signature,isnotnull(signature_id) AND signature_id!=\"\" AND signature_id!=\"unknown\",signature_id,1=1,\"unknown\")" + }, + { + "calculationID": "Updates_fillnull_signature_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The ID of the patch requirement detected on the client (the src). Note: Use signature for human-readable signature names.", + "recommended": true + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "case(isnotnull(signature_id) AND signature_id!=\"\",signature_id,isnotnull(signature) AND signature!=\"\" AND signature!=\"unknown\",signature,1=1,\"unknown\")" + }, + { + "calculationID": "Updates_fillnull_status", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Indicates the status of a given patch requirement.", + "expected_values": [ + "available", + "installed", + "invalid", + "restart required" + ], + "recommended": true + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(status) OR status=\"\",\"unknown\",status)" + }, + { + "calculationID": "Updates_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product of the patch monitoring product, such as Lumension Patch Manager. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Updates_indexes`) tag=update tag=status" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "update", + "status" + ] + }, + "objectName": "Available_Updates", + "displayName": "Available Updates", + "parentName": "Updates", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "status=\"available\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "update", + "status" + ] + }, + "objectName": "Installed_Updates", + "displayName": "Installed Updates", + "parentName": "Updates", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "status=\"installed\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "update", + "status" + ] + }, + "objectName": "Restart_Required_Updates", + "displayName": "Updates Requiring Restart", + "parentName": "Updates", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "status=\"restart_required\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "update", + "error" + ] + }, + "objectName": "Update_Errors", + "displayName": "Update Errors", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The event timestamp expressed in Unix time.", + "ta_relevant": false + }, + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The host associated with the search.", + "ta_relevant": false + }, + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source associated with the search.", + "ta_relevant": false + }, + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source type associated with the search.", + "ta_relevant": false + }, + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Updates_indexes`) tag=update tag=error", + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Vulnerabilities.json b/bin/datamodels/Vulnerabilities.json new file mode 100644 index 0000000000..9c0bb67f9a --- /dev/null +++ b/bin/datamodels/Vulnerabilities.json @@ -0,0 +1,538 @@ +{ + "modelName": "Vulnerabilities", + "displayName": "Vulnerabilities", + "description": "Vulnerabilities Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "vulnerability", + "report" + ] + }, + "objectName": "Vulnerabilities", + "displayName": "Vulnerabilities", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "Numeric indicator of the common vulnerability scoring system." + }, + "fieldName": "cvss", + "displayName": "cvss", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_bunit", + "displayName": "dvc_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_category", + "displayName": "dvc_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_priority", + "displayName": "dvc_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The URL involved in the discovered vulnerability." + }, + "fieldName": "url", + "displayName": "url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The user involved in the discovered vulnerability." + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Vulnerabilities_lower_bugtraq", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The identifier in the vulnerability database provided by the Security Focus website (searchable at http:\/\/www.securityfocus.com\/)." + }, + "fieldName": "bugtraq", + "displayName": "bugtraq", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnotnull(bugtraq) AND bugtraq!=\"\",lower(bugtraq),null())" + }, + { + "calculationID": "Vulnerabilities_fillnull_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The category of the discovered vulnerability, such as DoS. Note: This field is a string. Use category_id for numeric values. The category_id field is optional and thus is not included in the data model.", + "recommended": true + }, + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(category) OR category=\"\",\"unknown\",category)" + }, + { + "calculationID": "Vulnerabilities_lower_cert", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The identifier in the vulnerability database provided by the US Computer Emergency Readiness Team (US-CERT, searchable at http:\/\/www.kb.cert.org\/vuls\/)." + }, + "fieldName": "cert", + "displayName": "cert", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnotnull(cert) AND cert!=\"\",lower(cert),null())" + }, + { + "calculationID": "Vulnerabilities_lower_cve", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The identifier provided in the Common Vulnerabilities and Exposures index (searchable at http:\/\/cve.mitre.org).", + "recommended": true + }, + "fieldName": "cve", + "displayName": "cve", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnotnull(cve) AND cve!=\"\",lower(cve),null())" + }, + { + "calculationID": "Vulnerabilities_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The host with the discovered vulnerability. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Vulnerabilities_fillnull_dvc", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system that discovered the vulnerability. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.", + "recommended": true + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)" + }, + { + "calculationID": "Vulnerabilities_lower_msft", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The Microsoft Security Advisory number (http:\/\/technet.microsoft.com\/en-us\/security\/advisory\/)." + }, + "fieldName": "msft", + "displayName": "msft", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnotnull(msft) AND msft!=\"\",lower(msft),null())" + }, + { + "calculationID": "Vulnerabilities_lower_mskb", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The Microsoft Knowledge Base article number (http:\/\/support.microsoft.com\/kb\/)." + }, + "fieldName": "mskb", + "displayName": "mskb", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnotnull(mskb) AND mskb!=\"\",lower(mskb),null())" + }, + { + "calculationID": "Vulnerabilities_fillnull_severity", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The severity of the vulnerability detection event. Specific values are required. Use vendor_severity for the vendor's own human readable strings (such as Good, Bad, and Really Bad). Note: This field is a string. Use severity_id for numeric data types. The severity_id field is optional and not included in the data model.", + "expected_values": [ + "critical", + "high", + "medium", + "low", + "informational" + ], + "recommended": true + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)" + }, + { + "calculationID": "Vulnerabilities_fillnull_signature", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the vulnerability detected on the host, such as HPSBMU02785 SSRT100526 rev.2 - HP LoadRunner Running on Windows, Remote Execution of Arbitrary Code, Denial of Service (DoS). Note: This field has a string value. Use signature_id for numeric indicators. The signature_id field is optional and thus is not included in the data model.", + "recommended": true + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)" + }, + { + "calculationID": "Vulnerabilities_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product that detected the vulnerability. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + }, + { + "calculationID": "Vulnerabilities_lower_xref", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "A cross-reference identifier associated with the vulnerability. In most cases, the xref field contains both the short name of the database being cross-referenced and the unique identifier used in the external database." + }, + "fieldName": "xref", + "displayName": "xref", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnotnull(xref) AND xref!=\"\",lower(xref),null())" + } + ], + "constraints": [ + { + "search": "(`cim_Vulnerabilities_indexes`) tag=vulnerability tag=report" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "vulnerability", + "report" + ] + }, + "objectName": "High_Critical_Vulnerabilities", + "displayName": "High Or Critical Vulnerabilities", + "parentName": "Vulnerabilities", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(severity=\"high\" OR severity=\"critical\")" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "vulnerability", + "report" + ] + }, + "objectName": "Medium_Vulnerabilities", + "displayName": "Medium Vulnerabilities", + "parentName": "Vulnerabilities", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "severity=\"medium\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "vulnerability", + "report" + ] + }, + "objectName": "Low_Informational_Vulnerabilities", + "displayName": "Low Or Informational Vulnerabilities", + "parentName": "Vulnerabilities", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(severity=\"low\" OR severity=\"informational\")" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/bin/datamodels/Web.json b/bin/datamodels/Web.json new file mode 100644 index 0000000000..9b44b67498 --- /dev/null +++ b/bin/datamodels/Web.json @@ -0,0 +1,806 @@ +{ + "modelName": "Web", + "displayName": "Web", + "description": "Web Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "web" + ] + }, + "objectName": "Web", + "displayName": "Web", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The application detected or hosted by the server/site such as wordpress, splunk, or facebook." + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Indicates whether the event data is cached or not.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "cached", + "displayName": "cached", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of traffic, such as may be provided by a proxy server." + }, + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The cookie file recorded in the event." + }, + "fieldName": "cookie", + "displayName": "cookie", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The destination port of the web traffic." + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time taken by the proxy event, in milliseconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response, if applicable, in milliseconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The virtual site which services the request, if applicable." + }, + "fieldName": "site", + "displayName": "site", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The path of the resource served by the webserver or proxy." + }, + "fieldName": "uri_path", + "displayName": "uri_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The path of the resource requested by the client." + }, + "fieldName": "uri_query", + "displayName": "uri_query", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Web_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action taken by the server or proxy.", + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Web_bytes", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The total number of bytes transferred (bytes_in + bytes_out).", + "recommended": true + }, + "fieldName": "bytes", + "displayName": "bytes", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(bytes),bytes,isnum(bytes_in) AND isnum(bytes_out),bytes_in+bytes_out,1=1,null())" + }, + { + "calculationID": "Web_bytes_in", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The number of inbound bytes transferred.", + "recommended": true + }, + "fieldName": "bytes_in", + "displayName": "bytes_in", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(bytes_in),bytes_in,isnum(bytes) AND isnum(bytes_out),bytes-bytes_out,1=1,null())" + }, + { + "calculationID": "Web_bytes_out", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The number of outbound bytes transferred.", + "recommended": true + }, + "fieldName": "bytes_out", + "displayName": "bytes_out", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(bytes_out),bytes_out,isnum(bytes) AND isnum(bytes_in),bytes-bytes_in,1=1,null())" + }, + { + "calculationID": "Web_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination of the network traffic (the remote host). You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\" OR dest=\"-\",\"unknown\",dest)" + }, + { + "calculationID": "Web_fillnull_http_content_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The content-type of the requested HTTP resource.", + "recommended": true + }, + "fieldName": "http_content_type", + "displayName": "http_content_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(http_content_type) OR http_content_type=\"\" OR http_content_type=\"-\",\"unknown\",http_content_type)" + }, + { + "calculationID": "Web_fillnull_http_method", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The HTTP method used in the request.", + "expected_values": [ + "GET", + "PUT", + "POST", + "DELETE", + "HEAD", + "OPTIONS", + "CONNECT", + "TRACE" + ], + "recommended": true + }, + "fieldName": "http_method", + "displayName": "http_method", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(http_method) OR http_method=\"\" OR http_method=\"-\",\"unknown\",http_method)" + }, + { + "calculationID": "0Web_fillnull_http_referrer", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The HTTP referrer used in the request. The W3C specification and many implementations misspell this as http_referer. Use a FIELDALIAS to handle both key names.", + "recommended": true + }, + "fieldName": "http_referrer", + "displayName": "http_referrer", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(http_referrer) OR http_referrer=\"\" OR http_referrer=\"-\",\"unknown\",http_referrer)" + }, + { + "calculationID": "1Web_http_referrer_domain", + "calculationType": "Rex", + "inputField": "http_referrer", + "outputFields": [ + { + "comment": { + "description": "The domain name contained within the HTTP referrer used in the request.", + "recommended": true + }, + "fieldName": "http_referrer_domain", + "displayName": "http_referrer_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "^(?:http|https|ftp):\\\/\\\/(?:[a-zA-Z0-9\\.\\-]+(?::[a-zA-Z0-9]+)?@)?(?[^\\\/:]+)(?::[0-9]+)?" + }, + { + "calculationID": "Web_fillnull_http_user_agent", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user agent used in the request.", + "recommended": true + }, + "fieldName": "http_user_agent", + "displayName": "http_user_agent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(http_user_agent) OR http_user_agent=\"\" OR http_user_agent=\"-\",\"unknown\",http_user_agent)" + }, + { + "calculationID": "Web_http_user_agent_length", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The length of the user agent used in the request.", + "ta_relevant": false + }, + "fieldName": "http_user_agent_length", + "displayName": "http_user_agent_length", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "len(http_user_agent)" + }, + { + "calculationID": "Web_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source of the network traffic (the client requesting the connection).", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\" OR src=\"-\",\"unknown\",src)" + }, + { + "calculationID": "Web_fillnull_status", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The HTTP response code indicating the status of the proxy request.", + "expected_values": [ + "100", + "101", + "102", + "200", + "201", + "202", + "203", + "204", + "205", + "206", + "207", + "208", + "226", + "300", + "301", + "302", + "303", + "304", + "305", + "306", + "307", + "308", + "400", + "401", + "402", + "403", + "404", + "405", + "406", + "407", + "408", + "409", + "410", + "411", + "412", + "413", + "414", + "415", + "416", + "417", + "422", + "423", + "424", + "426", + "428", + "429", + "431", + "500", + "501", + "502", + "503", + "504", + "505", + "506", + "507", + "508", + "510", + "511" + ], + "recommended": true + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(status) OR status=\"\" OR status=\"-\",\"unknown\",status)" + }, + { + "calculationID": "0Web_fillnull_url", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The URL of the requested HTTP resource.", + "recommended": true + }, + "fieldName": "url", + "displayName": "url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(url) OR url=\"\" OR url=\"-\",\"unknown\",url)" + }, + { + "calculationID": "1Web_url_domain", + "calculationType": "Rex", + "inputField": "url", + "outputFields": [ + { + "comment": { + "description": "The domain name contained within the URL of the requested HTTP resource.", + "recommended": true + }, + "fieldName": "url_domain", + "displayName": "url_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "^(?:http|https|ftp):\\\/\\\/(?:[a-zA-Z0-9\\.\\-]+(?::[a-zA-Z0-9]+)?@)?(?[^\\\/:]+)(?::[0-9]+)?" + }, + { + "calculationID": "2Web_url_length", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The length of the URL.", + "ta_relevant": false + }, + "fieldName": "url_length", + "displayName": "url_length", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "len(url)" + }, + { + "calculationID": "Web_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user that requested the HTTP resource.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Web_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product of the proxy server, such as Squid Proxy Server. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Web_indexes`) tag=web" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "web", + "proxy" + ] + }, + "objectName": "Proxy", + "displayName": "Proxy", + "parentName": "Web", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=proxy" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "web", + "storage" + ] + }, + "objectName": "Storage", + "displayName": "Storage", + "parentName": "Web", + "fields": [ + { + "comment": { + "description": "The name of the bucket or storage account.", + "ta_relevant": false + }, + "fieldName": "storage_name", + "displayName": "storage_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The operation performed on the storage account.", + "ta_relevant": false + }, + "fieldName": "operation", + "displayName": "operation", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The error code that occurred while accessing the storage account.", + "ta_relevant": false + }, + "fieldName": "error_code", + "displayName": "error_code", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=storage" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file