Lookups for the Splunk Add-on for RSA SecurID

The lookup files map fields from RSA Authentication Manager logs to CIM-compliant values in the Splunk platform. The lookup files are located in $SPLUNK_HOME/etc/apps/Splunk_TA_rsa-securid/lookups.

}

Filename	Description
rsa_securid_actions.csv	Maps vendor_action_for_cim_obj to action.
rsa_securid_severity_lookup.csv	Maps log_level to severity.
rsa_securid_change_status.csv	Maps vendor_action to status.
rsa_securid_admin_events_mapping.csv	Maps admin events to its corresponding event type. 1) Principal related events are mapped with event_type = "principal_event" 2) Token/PIN related events are mapped with event_type = "audit_event".
rsa_securid_action_field.csv	Maps vendor_action_id and vendor_action_description to action.
rsa_securid_alert_type_lookup.csv	Maps vendor_action to type.
rsa_securid_change_events_fields.csv	Maps vendor_action_id and vendor_action_descriptionto action, object_category, object, change_type, object_attrs, and status.
rsa_securid_data_model_mapping.csv	Maps vendor_action_id and vendor_action_descriptionto event_type.