Non-CIM complaint mapping for cloud storage data
Use the following table to map the Splunk CIM field name to the non-CIM field name for cloud storage data. You can use the impala field names to validate the mapping values. The SPL examples show how to adjust field names and values to get cloud storage data into Splunk UBA correctly:
Splunk CIM field name Non-CIM field name example Impala table field (fileaccess_s) Example values ((Field_name, Filed_value) SPL example file_size FILE_SIZE_BYTE resourcesize (FILE_SIZE_BYTE: 10280) rename FILE_SIZE_BYTE
asfile_size
object SOURCE_FILE_NAME resourcename (SOURCE_FILE_NAME,'this_picture.png') rename SOURCE_FILE_NAME
asobject
object_type ITEM_TYPE resourcetype ITEM_TYPE, 'File')
(ITEM_TYPE, 'Folder')
(ITEM_TYPE, 'Document')
(ITEM_TYPE, 'Image')rename ITEM_TYPE
asobject_type
file_hash ITEM_UNIQUE_ID resourceid (ITEM_UNIQUE_ID, '17283982137') rename ITEM_UNIQUE_ID
asfile_hash
object_path FILE_PATH source (FILE_PATH, '/bpatinho/photos') rename FilePath
asobject_path
parent_category PARENT_RS_TYPE parentpathtype (PARENT_RS_TYPE, 'Folder')
(PARENT_RS_TYPE, 'Link')rename PARENT_RS_TYPE
asparent_category
parent_hash PARENT_HASH_ID parentpathid (PARENT_HASH_ID, '9864239674') rename PARENT_HASH_ID
asparent_hash
src_user SRC_USER source (SRC_USER, 'user1')
(SRC_USER,'user2')rename SRC_USER
assrc_user
change_type OPERATION evcls (Operation,' FileDownload')
(OPERATION,'FILEPREVIEW')(OPERATION,'FILEDELETE')
(OPERATION,'FILECREATE')
(OPERATION,'FILEEDIT')| eval change_type=case(match(lower(change_type), "FILEDELETE","delete", match(lower(change_type)," FileDownload"), "download", match(lower(change_type), "FILECOPIED"),"create", match(lower(change_type)," FILEPREVIEW"),"preview", match(lower(change_type), "FILEEDIT"),"edit")
app APP_NAME servicename (APP_NAME,'Box')
(APP_NAME,' Office365')
(APP_NAME,' Google Drive')rename APP_NAME
asapp
dest_user DEST_USER destinationusername (DEST_USER, 'Cronaldo') rename DEST_USER
asdest_user
Configure the VirusTotal script to see VirusTotal anomalies in Splunk UBA | Verify that you successfully added the data source |
This documentation applies to the following versions of Splunk® User Behavior Analytics: 5.2.0, 5.2.1, 5.3.0, 5.4.0, 5.4.1
Feedback submitted, thanks!