admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
UpdateRequiredFields
splunk-security_content/bin/base_datamodels/Application_State.json
T

502 lines
16 KiB
JSON
Raw Permalink Blame History

{
"modelName": "Application_State",
"displayName": "Application State (Deprecated)",
"description": "This model has been deprecated",
"editable": false,
"objects": [
{
"comment": {
"ta_relevant": false
},
"objectName": "All_Application_State",
"displayName": "All Application State",
"parentName": "BaseEvent",
"fields": [
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "dest_bunit",
"displayName": "dest_bunit",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "dest_category",
"displayName": "dest_category",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "dest_priority",
"displayName": "dest_priority",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "dest_requires_av",
"displayName": "dest_requires_av",
"type": "boolean",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "dest_should_timesync",
"displayName": "dest_should_timesync",
"type": "boolean",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "dest_should_update",
"displayName": "dest_should_update",
"type": "boolean",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
"ta_relevant": false
},
"fieldName": "tag",
"displayName": "tag",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "The user account the service is running as, such as System or httpdsvc."
},
"fieldName": "user",
"displayName": "user",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_bunit",
"displayName": "user_bunit",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_category",
"displayName": "user_category",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "user_priority",
"displayName": "user_priority",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
{
"calculationID": "All_Application_State_fillnull_dest",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The compute resource where the service is installed. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
"recommended": true
},
"fieldName": "dest",
"displayName": "dest",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
},
{
"calculationID": "All_Application_State_fillnull_process",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The name of a process or service file, such as sqlsrvr.exe or httpd. Note: This field is not appropriate for service or daemon names, such as SQL Server or Apache Web Server. Service or daemon names belong to the service field.",
"recommended": true
},
"fieldName": "process",
"displayName": "process",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(process) OR process=\"\",\"unknown\",process)"
},
{
"calculationID": "All_Application_State_fillnull_process_name",
"calculationType": "Rex",
"outputFields": [
{
"comment": {
"description": "The name of a process.",
"ta_relevant": false
},
"fieldName": "process_name",
"displayName": "process_name",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"inputField": "process",
"expression": "^\\s*(?<process_name>[^\\s]+)"
}
],
"constraints": [
{
"search": "(`cim_Application_State_indexes`) (tag=listening tag=port) OR (tag=process tag=report) OR (tag=service tag=report)"
}
],
"children": [
]
},
{
"comment": {
"tags": [
"listening",
"port"
]
},
"objectName": "Ports",
"displayName": "Ports",
"parentName": "All_Application_State",
"fields": [
],
"calculations": [
{
"calculationID": "Ports_fillnull_dest_port",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "Network ports communicated to by the process, such as 53.",
"recommended": true
},
"fieldName": "dest_port",
"displayName": "dest_port",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
}
],
"expression": "if(isnum(dest_port),dest_port,0)"
},
{
"calculationID": "Ports_fillnull_transport",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The network ports listened to by the application process, such as tcp, udp, etc.",
"recommended": true
},
"fieldName": "transport",
"displayName": "transport",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
}
],
"expression": "if(isnull(transport) OR transport=\"\",\"unknown\",lower(transport))"
},
{
"calculationID": "Ports_transport_dest_port",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "Calculated as transport\/dest_port, such as tcp\/53.",
"ta_relevant": false
},
"fieldName": "transport_dest_port",
"displayName": "transport_dest_port",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
}
],
"expression": "if(isnull(transport_dest_port) OR transport_dest_port=\"\",split(replace(mvjoin(mvzip(transport,dest_port),\"|\"),\",\",\"\/\"),\"|\"),transport_dest_port)"
}
],
"constraints": [
{
"search": "tag=listening tag=port"
}
],
"children": [
]
},
{
"comment": {
"tags": [
"process",
"report"
]
},
"objectName": "Processes",
"displayName": "Processes",
"parentName": "All_Application_State",
"fields": [
{
"comment": {
"description": "CPU Load in megahertz."
},
"fieldName": "cpu_load_mhz",
"displayName": "cpu_load_mhz",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "CPU Load in percent."
},
"fieldName": "cpu_load_percent",
"displayName": "cpu_load_percent",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "CPU Time."
},
"fieldName": "cpu_time",
"displayName": "cpu_time",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "Memory used in bytes."
},
"fieldName": "mem_used",
"displayName": "mem_used",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
],
"constraints": [
{
"search": "tag=process tag=report"
}
],
"children": [
]
},
{
"comment": {
"tags": [
"service",
"report"
]
},
"objectName": "Services",
"displayName": "Services",
"parentName": "All_Application_State",
"fields": [
],
"calculations": [
{
"calculationID": "Services_fillnull_service",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The name of the service, such as SQL Server or Apache Web Server. Note: This field is not appropriate for filenames, such as sqlsrvr.exe or httpd. Filenames should belong to the process field instead. Also, note that field is a string. Use the service_id field for service ID fields that are integer data types.",
"recommended": true
},
"fieldName": "service",
"displayName": "service",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(service) OR service=\"\",\"unknown\",service)"
},
{
"calculationID": "Services_fillnull_service_id",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "A numeric indicator for a service.",
"recommended": true
},
"fieldName": "service_id",
"displayName": "service_id",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(service_id) OR service_id=\"\",\"unknown\",service_id)"
},
{
"calculationID": "Services_fillnull_start_mode",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The start mode for the service.",
"expected_values": [
"disabled",
"manual",
"auto"
],
"recommended": true
},
"fieldName": "start_mode",
"displayName": "start_mode",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(start_mode) OR start_mode=\"\",\"unknown\",start_mode)"
},
{
"calculationID": "Services_fillnull_status",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The status of the service.",
"expected_values": [
"critical",
"started",
"stopped",
"warning"
],
"recommended": true
},
"fieldName": "status",
"displayName": "status",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(status) OR status=\"\",\"unknown\",status)"
}
],
"constraints": [
{
"search": "tag=service tag=report"
}
],
"children": [
]
}
]
}
Reference in New Issue View Git Blame Copy Permalink