Data Loss Prevention
The fields in the Data Loss Prevention (DLP) data model describe events gathered from DLP tools used to identify, monitor and protect data.
Note: A dataset is a component of a data model. In versions of the Splunk platform prior to version 6.5.0, these were referred to as data model objects.
Tags used with DLP event datasets
The following tags act as constraints to identify your events as being relevant to this data model. For more information, see How to use these reference tables.
Dataset name | Tag name |
---|---|
DLP_Incidents | dlp |
incident |
Fields for DLP event datasets
The following table lists the extracted and calculated fields for the event datasets in the model. The table does not include any inherited fields. For more information, see How to use these reference tables.
Dataset name | Field name | Data type | Description | Abbreviated list of example values |
---|---|---|---|---|
DLP_Incidents | action |
string | The action taken by the DLP device. | |
DLP_Incidents | app |
string | The application involved in the event. | |
DLP_Incidents | category |
string | The category of the DLP event. | |
DLP_Incidents | dest |
string | The target of the DLP event. | |
DLP_Incidents | dest_bunit |
string | The business unit of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | dest_category |
string | The category of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | dest_priority |
string | The priority of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | dest_zone |
string | The zone of the DLP target. | |
DLP_Incidents | dlp_type |
string | The type of DLP system that generated the event. | |
DLP_Incidents | dvc |
string | The device that reported the DLP event. | |
DLP_Incidents | dvc_bunit |
string | The business unit of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | dvc_category |
string | The category of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | dvc_priority |
string | The priority of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | dvc_zone |
string | The zone of the DLP device. | |
DLP_Incidents | object |
string | The name of the affected object. | |
DLP_Incidents | object_category |
string | The category of the affected object. | |
DLP_Incidents | object_path |
string | The path of the affected object. | |
DLP_Incidents | severity |
string | The severity of the DLP event. | |
DLP_Incidents | signature |
string | The name of the DLP event. | |
DLP_Incidents | src |
string | The source of the DLP event. | |
DLP_Incidents | src_bunit |
string | The business unit of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | src_category |
string | The category of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | src_priority |
string | The priority of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | src_user |
string | The source user of the DLP event. | |
DLP_Incidents | src_user_bunit |
string | The business unit of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | src_user_category |
string | The category of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | src_user_priority |
string | The priority of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | src_zone |
string | The zone of the DLP source. | |
DLP_Incidents | tag |
string | This automatically generated field is used to access tags from within datamodels. Do not define extractions for this field when writing add-ons. | |
DLP_Incidents | user |
string | The target user of the DLP event. | |
DLP_Incidents | user_bunit |
string | The business unit of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | user_category |
string | The category of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | user_priority |
string | The priority of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons. |
|
DLP_Incidents | vendor_product |
string | The vendor and product name of the DLP system. |
Databases |
This documentation applies to the following versions of Splunk® Common Information Model Add-on: 4.5.0, 4.6.0, 4.7.0, 4.8.0, 4.9.0, 4.9.1, 4.10.0, 4.11.0, 4.12.0, 4.13.0, 4.14.0, 4.15.0
Feedback submitted, thanks!