splunk-security_content/bin/datamodels/Event_Signatures.json

{
  "modelName": "Event_Signatures",
  "displayName": "Event Signatures",
  "description": "Event Signatures Data Model",
  "editable": false,
  "objects": [
    {
      "comment": {
        "tags": [
          "track_event_signatures"
        ]
      },
      "objectName": "Signatures",
      "displayName": "Signatures",
      "parentName": "BaseEvent",
      "fields": [
        {
          "comment": {
            "description": "System affected by the signature."
          },
          "fieldName": "dest",
          "displayName": "dest",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "dest_bunit",
          "displayName": "dest_bunit",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "dest_category",
          "displayName": "dest_category",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": true,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "dest_priority",
          "displayName": "dest_priority",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        },
        {
          "comment": {
            "description": "The human readable event name."
          },
          "fieldName": "signature",
          "displayName": "signature",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        },
        {
          "comment": {
            "description": "The event name identifier (as supplied by the vendor)."
          },
          "fieldName": "signature_id",
          "displayName": "signature_id",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        },
        {
          "comment": {
            "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
            "ta_relevant": false
          },
          "fieldName": "tag",
          "displayName": "tag",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": true,
          "hidden": false
        }
      ],
      "calculations": [
        {
          "calculationID": "Signatures_vendor_product",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The vendor and product name of the technology that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.",
                "recommended": true
              },
              "fieldName": "vendor_product",
              "displayName": "vendor_product",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
        }
      ],
      "constraints": [
        {
          "search": "(`cim_Event_Signatures_indexes`) tag=track_event_signatures (signature=* OR signature_id=*)"
        }
      ],
      "children": []
    }
  ]
}