Data Loss Prevention

The fields in the Data Loss Prevention (DLP) data model describe events gathered from DLP tools used to identify, monitor and protect data.

Note: A dataset is a component of a data model. In versions of the Splunk platform prior to version 6.5.0, these were referred to as data model objects.

Tags used with DLP event datasets

The following tags act as constraints to identify your events as being relevant to this data model. For more information, see How to use these reference tables.

Dataset name	Tag name
DLP_Incidents	dlp
	incident

Fields for DLP event datasets

The following table lists the extracted and calculated fields for the event datasets in the model. The table does not include any inherited fields. For more information, see How to use these reference tables.

The key for using the column titled "Abbreviated list of example values" follows:

• Recommended are fields derived from the "recommended=true" JSON parameter that the TA developers need to make best efforts to map
• Prescribed fields are the permitted values that can populate the fields, which are derived from the "expected_values" JSON parameter
• Other values are other example values that you might see

Dataset name	Field name	Data type	Description	Abbreviated list of example values
DLP_Incidents	action	string	The action taken by the DLP device.	recommended
DLP_Incidents	app	string	The application involved in the event.
DLP_Incidents	category	string	The category of the DLP event.	recommended
DLP_Incidents	dest	string	The target of the DLP event.	recommended
DLP_Incidents	dest_bunit	string	The business unit of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	dest_category	string	The category of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	dest_priority	string	The priority of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	dest_zone	string	The zone of the DLP target.
DLP_Incidents	dlp_type	string	The type of DLP system that generated the event.	recommended
DLP_Incidents	dvc	string	The device that reported the DLP event.	recommended
DLP_Incidents	dvc_bunit	string	The business unit of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	dvc_category	string	The category of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	dvc_priority	string	The priority of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	dvc_zone	string	The zone of the DLP device.
DLP_Incidents	object	string	The name of the affected object.	recommended
DLP_Incidents	object_category	string	The category of the affected object.	recommended
DLP_Incidents	object_path	string	The path of the affected object.	recommended
DLP_Incidents	severity	string	The severity of the DLP event.	recommended
DLP_Incidents	signature	string	The name of the DLP event.	recommended
DLP_Incidents	src	string	The source of the DLP event.	recommended
DLP_Incidents	src_bunit	string	The business unit of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	src_category	string	The category of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	src_priority	string	The priority of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	src_user	string	The source user of the DLP event.	recommended
DLP_Incidents	src_user_bunit	string	The business unit of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	src_user_category	string	The category of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	src_user_priority	string	The priority of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	src_zone	string	The zone of the DLP source.
DLP_Incidents	tag	string	This automatically generated field is used to access tags from within datamodels. Do not define extractions for this field when writing add-ons.
DLP_Incidents	user	string	The target user of the DLP event.	recommended
DLP_Incidents	user_bunit	string	The business unit of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	user_category	string	The category of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	user_priority	string	The priority of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.
DLP_Incidents	vendor_product	string	The vendor and product name of the DLP system.	recommended