Data Manager

User Manual

This documentation does not apply to the most recent version of Data Manager. For documentation on the most recent version, go to the latest release.

Overview of source types for Data Manager

You can use Data Manager to ingest data of the following source types.

Getting data in for AWS

You can get data in for the following AWS data sources.

Data Source Description Source Type and Example Event
Amazon API Gateway Amazon API Gateway is an AWS service for creating, publishing, maintaining, monitoring, and securing REST, HTTP, and WebSocket APIs at any scale. Amazon API Gateway reports metrics through Amazon CloudWatch. Source type:

aws:cloudwatchlogs

Example event: 

{ [-]
   additionalEventData: { [+]
   }
   awsRegion: us-east-1
   eventCategory: Management
   eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef
   eventName: GetBucketAcl
   eventSource: s3.amazonaws.com
   eventTime: 2021-05-12T23:09:48Z
   eventType: AwsApiCall
   eventVersion: 1.08
   managementEvent: true
   readOnly: true
   recipientAccountId: 486996137179
   requestID: B9V4WAKPAR6Q0M20
   requestParameters: { [+]
   }
   resources: [ [+]
   ]
   responseElements: null
   sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f
   sourceIPAddress: cloudtrail.amazonaws.com
   userAgent: cloudtrail.amazonaws.com
   userIdentity: { [+]
   }
}
AWS CloudHSM AWS CloudHSM is a cloud-based hardware security module (HSM) that lets you generate and use your own encryption keys on the AWS Cloud. Source type:

aws:cloudwatchlogs

Example event: 

{ [-]
   additionalEventData: { [+]
   }
   awsRegion: us-east-1
   eventCategory: Management
   eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef
   eventName: GetBucketAcl
   eventSource: s3.amazonaws.com
   eventTime: 2021-05-12T23:09:48Z
   eventType: AwsApiCall
   eventVersion: 1.08
   managementEvent: true
   readOnly: true
   recipientAccountId: 486996137179
   requestID: B9V4WAKPAR6Q0M20
   requestParameters: { [+]
   }
   resources: [ [+]
   ]
   responseElements: null
   sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f
   sourceIPAddress: cloudtrail.amazonaws.com
   userAgent: cloudtrail.amazonaws.com
   userIdentity: { [+]
   }
}
AWS CloudTrail AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. Source type:

aws:cloudtrail

Example event: 

{ [-]
   additionalEventData: { [+]
   }
   awsRegion: us-east-1
   eventCategory: Management
   eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef
   eventName: GetBucketAcl
   eventSource: s3.amazonaws.com
   eventTime: 2021-05-12T23:09:48Z
   eventType: AwsApiCall
   eventVersion: 1.08
   managementEvent: true
   readOnly: true
   recipientAccountId: 486996137179
   requestID: B9V4WAKPAR6Q0M20
   requestParameters: { [+]
   }
   resources: [ [+]
   ]
   responseElements: null
   sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f
   sourceIPAddress: cloudtrail.amazonaws.com
   userAgent: cloudtrail.amazonaws.com
   userIdentity: { [+]
   }
}
Amazon DocumentDB Amazon DocumentDB (with MongoDB compatibility) is a fully managed database service that is purpose-built for JSON data management at scale. Source type:

aws:cloudwatchlogs

Example event: 

{ [-]
   additionalEventData: { [+]
   }
   awsRegion: us-east-1
   eventCategory: Management
   eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef
   eventName: GetBucketAcl
   eventSource: s3.amazonaws.com
   eventTime: 2021-05-12T23:09:48Z
   eventType: AwsApiCall
   eventVersion: 1.08
   managementEvent: true
   readOnly: true
   recipientAccountId: 486996137179
   requestID: B9V4WAKPAR6Q0M20
   requestParameters: { [+]
   }
   resources: [ [+]
   ]
   responseElements: null
   sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f
   sourceIPAddress: cloudtrail.amazonaws.com
   userAgent: cloudtrail.amazonaws.com
   userIdentity: { [+]
   }
}
Amazon EKS Amazon EKS is a managed service that you can use to run Kubernetes on AWS without installing, operating, and maintaining your own Kubernetes control plane or nodes. Source type:

aws:cloudwatchlogs

Example event: 

{ [-]
   additionalEventData: { [+]
   }
   awsRegion: us-east-1
   eventCategory: Management
   eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef
   eventName: GetBucketAcl
   eventSource: s3.amazonaws.com
   eventTime: 2021-05-12T23:09:48Z
   eventType: AwsApiCall
   eventVersion: 1.08
   managementEvent: true
   readOnly: true
   recipientAccountId: 486996137179
   requestID: B9V4WAKPAR6Q0M20
   requestParameters: { [+]
   }
   resources: [ [+]
   ]
   responseElements: null
   sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f
   sourceIPAddress: cloudtrail.amazonaws.com
   userAgent: cloudtrail.amazonaws.com
   userIdentity: { [+]
   }
}
Amazon GuardDuty Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3. Source type:

aws:cloudwatch:guardduty

Example event: 

{ [-]
   accountId: 467463828374
   arn: arn:aws:guardduty:us-west-2:467463828374:detector/66b9e579d125e7ca30e97cd350f3cc06/finding/28b9e580b2e3aafe7570484bcdf11b12
   createdAt: 2021-05-12T19:41:31.000000Z
   description: API ListStacks was invoked using root credentials from IP address 91.10.46.14.
   id: 28b9e580b2e3aafe7570484bcdf11b12
   partition: aws
   region: us-west-2
   resource: { [+]
   }
   schemaVersion: 2.0
   service: { [+]
   }
   severity: 3
   title: API ListStacks was invoked using root credentials.
   type: Policy:IAMUser/RootCredentialUsage
   updatedAt: 2021-05-12T19:41:31.000000Z
}
AWS IAM Access Analyzer AWS IAM Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. Source type:

aws:accessanalyzer:finding

Example event: 

{ [-]
   accountId: 55000000000
   action: [ [+]
   ]
   analyzedAt: 2021-02-04T17:21:23.130Z
   condition: { [+]
   }
   createdAt: 2021-02-04T17:21:23.130Z
   id: 723cc4fd-97bc-43b8-8932-6889c4070e0e
   isDeleted: false
   isPublic: false
   principal: { [+]
   }
   region: us-west-2
   resource: arn:aws:iam::55000000000:role/SplunkDMStackSetExecutionRole
   resourceType: AWS::IAM::Role
   status: ACTIVE
   updatedAt: 2021-02-04T17:21:23.130Z
   version: 1.0
}
AWS IAM Credential Report AWS IAM Credential Report lists all users in your account and the status of their various credentials, including passwords, access keys, and MFA devices. Source type:

aws:iam:credentialreport

Example event: 

{ [-]
   access_key_1_active: false
   access_key_1_last_rotated: N/A
   access_key_1_last_used_date: N/A
   access_key_1_last_used_region: N/A
   access_key_1_last_used_service: N/A
   access_key_2_active: false
   access_key_2_last_rotated: N/A
   access_key_2_last_used_date: N/A
   access_key_2_last_used_region: N/A
   access_key_2_last_used_service: N/A
   account_id: 45000000000
   arn: arn:aws:iam::45000000000:root
   cert_1_active: false
   cert_1_last_rotated: N/A
   cert_2_active: false
   cert_2_last_rotated: N/A
   SplunkDM_aws_configid: d8b11c12-6707-11eb-95ab-02cbcd7b93b9
   mfa_active: true
   password_enabled: not_supported
   password_last_changed: not_supported
   password_last_used: 2020-12-09T21:15:59+00:00
   password_next_rotation: not_supported
   user: <root_account>
   user_creation_time: 2020-09-12T15:48:42+00:00
}
AWS Lambda AWS Lambda is a compute service that lets you run code without provisioning or managing servers. Source type:

aws:cloudwatchlogs

Example event: 

{ [-]
   additionalEventData: { [+]
   }
   awsRegion: us-east-1
   eventCategory: Management
   eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef
   eventName: GetBucketAcl
   eventSource: s3.amazonaws.com
   eventTime: 2021-05-12T23:09:48Z
   eventType: AwsApiCall
   eventVersion: 1.08
   managementEvent: true
   readOnly: true
   recipientAccountId: 486996137179
   requestID: B9V4WAKPAR6Q0M20
   requestParameters: { [+]
   }
   resources: [ [+]
   ]
   responseElements: null
   sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f
   sourceIPAddress: cloudtrail.amazonaws.com
   userAgent: cloudtrail.amazonaws.com
   userIdentity: { [+]
   }
}
Metadata Metadata is data about your instance that you can use to configure or manage items such as EC2 Instances, IAM Roles, and Security Groups. Source type:

aws:metadata

Example event: 

{ [-]
   AccountId: 486996137179
   Associations: [ [+]
   ]
   Entries: [ [+]
   ]
   IsDefault: true
   NetworkAclId: acl-ccf682a7
   OwnerId: 486996137179
   Region: us-east-2
   Tags: [ [+]
   ]
   VpcId: vpc-9cb73ef7
   SplunkDM_input_id: f992eedc-e815-4eaf-998f-894a994719ac
}
Amazon RDS Amazon RDS is a web service that allows users to set up, operate, and scale a relational database in the cloud. Source type:

aws:cloudwatchlogs

Example event: 

{ [-]
   additionalEventData: { [+]
   }
   awsRegion: us-east-1
   eventCategory: Management
   eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef
   eventName: GetBucketAcl
   eventSource: s3.amazonaws.com
   eventTime: 2021-05-12T23:09:48Z
   eventType: AwsApiCall
   eventVersion: 1.08
   managementEvent: true
   readOnly: true
   recipientAccountId: 486996137179
   requestID: B9V4WAKPAR6Q0M20
   requestParameters: { [+]
   }
   resources: [ [+]
   ]
   responseElements: null
   sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f
   sourceIPAddress: cloudtrail.amazonaws.com
   userAgent: cloudtrail.amazonaws.com
   userIdentity: { [+]
   }
}
AWS Security Hub AWS Security Hub gives you a comprehensive view of your security alerts and security posture across your AWS accounts. Source type:

aws:securityhub:finding

Example event: 

{ [-]
   AwsAccountId: 986546787665
   CreatedAt: 2021-05-12T19:40:31.000000Z
   Description: API ListStacks was invoked using root credentials from IP address 99.37.245.87.
   FirstObservedAt: 2021-05-12T19:40:31Z
   GeneratorId: arn:aws:guardduty:us-west-1:264962456697:detector/66b954920ec49f3fb2b48aac9f4dfe55
   Id: arn:aws:guardduty:us-west-1:264962456697:detector/66b954920ec49f3fb2b48aac9f4dfe55/finding/48b9761c3553de180eeae02247363b8d
   LastObservedAt: 2021-05-12T19:40:31Z
   ProductArn: arn:aws:securityhub:us-west-1::product/aws/guardduty
   ProductFields: { [+]
   }
   RecordState: ACTIVE
   Resources: [ [+]
   ]
   SchemaVersion: 2018-10-08
   Severity: { [+]
   }
   SourceUrl: https://us-west-1.console.aws.amazon.com/guardduty/home?region=us-west-1#/findings?macros=current&fId=48b9761c3553de180eeae02247363b8d
   Title: API ListStacks was invoked using root credentials.
   Types: [ [+]
   ]
   UpdatedAt: 2021-05-12T19:40:31.000000Z
   Workflow: { [+]
   }
   WorkflowState: NEW
}
Last modified on 18 March, 2022
Set up Data Manager   Data ingestion mechanisms and intervals in Data Manager

This documentation applies to the following versions of Data Manager: 1.4.0

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters