admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
da30ab13bbc67ac596a25dcb0fa7a9e557486b20
splunk-security_content/bin/datamodels/Network_Resolution.json
T

506 lines
17 KiB
JSON
Raw Blame History

{
"modelName": "Network_Resolution",
"displayName": "Network Resolution (DNS)",
"description": "Network Resolution Data Model",
"editable": false,
"objects": [
{
"comment": {
"tags": [
"network",
"resolution",
"dns"
]
},
"objectName": "DNS",
"displayName": "DNS",
"parentName": "BaseEvent",
"fields": [
{
"comment": {
"description": "Number of entries in the 'additional' section of the DNS message."
},
"fieldName": "additional_answer_count",
"displayName": "additional_answer_count",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "Number of entries in the 'authority' section of the DNS message."
},
"fieldName": "authority_answer_count",
"displayName": "authority_answer_count",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The business unit of the destination.",
"ta_relevant": false
},
"fieldName": "dest_bunit",
"displayName": "dest_bunit",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The category of the network resolution target, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "dest_category",
"displayName": "dest_category",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "The destination port number."
},
"fieldName": "dest_port",
"displayName": "dest_port",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The priority of the destination, if applicable.",
"ta_relevant": false
},
"fieldName": "dest_priority",
"displayName": "dest_priority",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The time taken by the network resolution event, in seconds."
},
"fieldName": "duration",
"displayName": "duration",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The name of the DNS event."
},
"fieldName": "name",
"displayName": "name",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "Number of entries that appear in the 'Questions' section of the DNS query.",
"expected_values": [
"Query",
"IQuery",
"Status",
"Notify",
"Update",
"A",
"MX",
"NS",
"PTR"
]
},
"fieldName": "query_type",
"displayName": "query_type",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The DNS resource record type. For details, see the List of DNS record types on Wikipedia.",
"expected_values": [
"A",
"DNAME",
"MX",
"NS",
"PTR"
]
},
"fieldName": "record_type",
"displayName": "record_type",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The amount of time it took to receive a response in the network resolution event, in seconds."
},
"fieldName": "response_time",
"displayName": "response_time",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The source of the network resolution event. You can alias this from more specific fields, such as src_host, src_ip, or src_name."
},
"fieldName": "src",
"displayName": "src",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The business unit of the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "src_bunit",
"displayName": "src_bunit",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The category of the source, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
"ta_relevant": false
},
"fieldName": "src_category",
"displayName": "src_category",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "The port number of the source."
},
"fieldName": "src_port",
"displayName": "src_port",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "The priority of the source.",
"ta_relevant": false
},
"fieldName": "src_priority",
"displayName": "src_priority",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
"ta_relevant": false
},
"fieldName": "tag",
"displayName": "tag",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
},
{
"comment": {
"description": "The transport protocol used by the network resolution event."
},
"fieldName": "transport",
"displayName": "transport",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The unique numerical transaction id of the network resolution event."
},
"fieldName": "transaction_id",
"displayName": "transaction_id",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
},
{
"comment": {
"description": "The time-to-live of the network resolution event, in seconds."
},
"fieldName": "ttl",
"displayName": "ttl",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"calculations": [
{
"calculationID": "DNS_0fillnull_answer",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "Resolved address for the query.",
"recommended": true
},
"fieldName": "answer",
"displayName": "answer",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
}
],
"expression": "if(isnull(answer) OR answer=\"\",\"unknown\",answer)"
},
{
"calculationID": "DNS_answer_count",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "Number of entries in the answer section of the DNS message.",
"ta_relevant": false
},
"fieldName": "answer_count",
"displayName": "answer_count",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "case(isnum(answer_count),answer_count,isnotnull(answer),mvcount(answer),1=1,1)"
},
{
"calculationID": "DNS_fillnull_dest",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The destination of the network resolution event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
"recommended": true
},
"fieldName": "dest",
"displayName": "dest",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
},
{
"calculationID": "DNS_fillnull_message_type",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "Type of DNS message.",
"expected_values": [
"Query",
"Response"
],
"recommended": true
},
"fieldName": "message_type",
"displayName": "message_type",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "if(isnull(message_type) OR message_type=\"\",\"unknown\",message_type)"
},
{
"calculationID": "DNS_0fillnull_query",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The domain which needs to be resolved. Applies to messages of type 'Query'.",
"recommended": true
},
"fieldName": "query",
"displayName": "query",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": true,
"hidden": false
}
],
"expression": "if(isnull(query) OR query=\"\",\"unknown\",query)"
},
{
"calculationID": "DNS_query_count",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "Number of entries that appear in the 'Questions' section of the DNS query.",
"ta_relevant": false
},
"fieldName": "query_count",
"displayName": "query_count",
"type": "number",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "case(isnum(query_count),query_count,isnotnull(query),mvcount(query),1=1,1)"
},
{
"calculationID": "DNS_0fillnull_reply_code_id",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The numerical id or name of a return code. For details, see the Domain Name System Parameters on the Internet Assigned Numbers Authority (IANA) web site.",
"expected_values": [
"0",
"NoError",
"1",
"FormErr",
"2",
"ServFail",
"3",
"NXDomain",
"etc."
],
"recommended": true
},
"fieldName": "reply_code_id",
"displayName": "reply_code_id",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "case(isnotnull(reply_code_id) AND reply_code_id!=\"\",reply_code_id,isnotnull(reply_code) AND reply_code!=\"\",reply_code,1=1,\"unknown\")"
},
{
"calculationID": "DNS_reply_code",
"calculationType": "Lookup",
"lookupName": "cim_dns_reply_code_lookup",
"lookupInputs": [
{
"inputField": "reply_code_id",
"lookupField": "reply_code_id"
}
],
"outputFields": [
{
"comment": {
"description": "The return code for the response. For details, see the Domain Name System Parameters on the Internet Assigned Numbers Authority (IANA) web site.",
"expected_values": [
"No Error",
"Format Error",
"Server Failure",
"Non-Existent Domain",
"etc."
],
"recommended": true
},
"lookupOutputFieldName": "reply_code",
"fieldName": "reply_code",
"displayName": "reply_code",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
]
},
{
"calculationID": "DNS_vendor_product",
"calculationType": "Eval",
"outputFields": [
{
"comment": {
"description": "The vendor product name of the DNS server. The Splunk platform can derive this field from the fields vendor and product in the raw data, if they exist.",
"recommended": true
},
"fieldName": "vendor_product",
"displayName": "vendor_product",
"type": "string",
"fieldSearch": "",
"required": false,
"multivalue": false,
"hidden": false
}
],
"expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
}
],
"constraints": [
{
"search": "(`cim_Network_Resolution_indexes`) tag=network tag=resolution tag=dns"
}
],
"children": [
]
}
]
}
Reference in New Issue View Git Blame Copy Permalink