Overview of source types for Data Manager

Use Data Manager to ingest data of the following source types.

Data Manager supports Common Information Model (CIM) normalization when the add-on that is applicable to your data input type is installed on the part of your Splunk Cloud deployment that performs the parsing or search-time functionality for your data. The applicable add-on must be installed, but does not need to be configured.

For more information on which add-on applies to your data input type, see the Prerequisites topic in the chapter of your cloud data input type in this manual.

For information on the CIM, see the Overview of the Splunk Common Information Model topic in the Common Information Model Add-on manual.

Getting data in for AWS

You can get data in for the following AWS data sources.

Data Source	Description	Source Type and Example Event
Amazon API Gateway	Amazon API Gateway is an AWS service for creating, publishing, maintaining, monitoring, and securing REST, HTTP, and WebSocket APIs at any scale. Amazon API Gateway reports metrics through Amazon CloudWatch.	Source type: aws:cloudwatchlogs Example event: { [-] additionalEventData: { [+] } awsRegion: us-east-1 eventCategory: Management eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef eventName: GetBucketAcl eventSource: s3.amazonaws.com eventTime: 2021-05-12T23:09:48Z eventType: AwsApiCall eventVersion: 1.08 managementEvent: true readOnly: true recipientAccountId: 486996137179 requestID: B9V4WAKPAR6Q0M20 requestParameters: { [+] } resources: [ [+] ] responseElements: null sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f sourceIPAddress: cloudtrail.amazonaws.com userAgent: cloudtrail.amazonaws.com userIdentity: { [+] } }
AWS CloudHSM	AWS CloudHSM is a cloud-based hardware security module (HSM) that lets you generate and use your own encryption keys on the AWS Cloud.	Source type: aws:cloudwatchlogs Example event: { [-] additionalEventData: { [+] } awsRegion: us-east-1 eventCategory: Management eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef eventName: GetBucketAcl eventSource: s3.amazonaws.com eventTime: 2021-05-12T23:09:48Z eventType: AwsApiCall eventVersion: 1.08 managementEvent: true readOnly: true recipientAccountId: 486996137179 requestID: B9V4WAKPAR6Q0M20 requestParameters: { [+] } resources: [ [+] ] responseElements: null sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f sourceIPAddress: cloudtrail.amazonaws.com userAgent: cloudtrail.amazonaws.com userIdentity: { [+] } }
AWS CloudTrail	AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account.	Source type: aws:cloudtrail Example event: { [-] additionalEventData: { [+] } awsRegion: us-east-1 eventCategory: Management eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef eventName: GetBucketAcl eventSource: s3.amazonaws.com eventTime: 2021-05-12T23:09:48Z eventType: AwsApiCall eventVersion: 1.08 managementEvent: true readOnly: true recipientAccountId: 486996137179 requestID: B9V4WAKPAR6Q0M20 requestParameters: { [+] } resources: [ [+] ] responseElements: null sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f sourceIPAddress: cloudtrail.amazonaws.com userAgent: cloudtrail.amazonaws.com userIdentity: { [+] } }
Amazon DocumentDB	Amazon DocumentDB (with MongoDB compatibility) is a fully managed database service that is purpose-built for JSON data management at scale.	Source type: aws:cloudwatchlogs Example event: { [-] additionalEventData: { [+] } awsRegion: us-east-1 eventCategory: Management eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef eventName: GetBucketAcl eventSource: s3.amazonaws.com eventTime: 2021-05-12T23:09:48Z eventType: AwsApiCall eventVersion: 1.08 managementEvent: true readOnly: true recipientAccountId: 486996137179 requestID: B9V4WAKPAR6Q0M20 requestParameters: { [+] } resources: [ [+] ] responseElements: null sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f sourceIPAddress: cloudtrail.amazonaws.com userAgent: cloudtrail.amazonaws.com userIdentity: { [+] } }
Amazon EKS	Amazon EKS is a managed service that you can use to run Kubernetes on AWS without installing, operating, and maintaining your own Kubernetes control plane or nodes.	Source type: aws:cloudwatchlogs Example event: { [-] additionalEventData: { [+] } awsRegion: us-east-1 eventCategory: Management eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef eventName: GetBucketAcl eventSource: s3.amazonaws.com eventTime: 2021-05-12T23:09:48Z eventType: AwsApiCall eventVersion: 1.08 managementEvent: true readOnly: true recipientAccountId: 486996137179 requestID: B9V4WAKPAR6Q0M20 requestParameters: { [+] } resources: [ [+] ] responseElements: null sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f sourceIPAddress: cloudtrail.amazonaws.com userAgent: cloudtrail.amazonaws.com userIdentity: { [+] } }
Amazon GuardDuty	Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3.	Source type: aws:cloudwatch:guardduty Example event: { [-] accountId: 467463828374 arn: arn:aws:guardduty:us-west-2:467463828374:detector/66b9e579d125e7ca30e97cd350f3cc06/finding/28b9e580b2e3aafe7570484bcdf11b12 createdAt: 2021-05-12T19:41:31.000000Z description: API ListStacks was invoked using root credentials from IP address 91.10.46.14. id: 28b9e580b2e3aafe7570484bcdf11b12 partition: aws region: us-west-2 resource: { [+] } schemaVersion: 2.0 service: { [+] } severity: 3 title: API ListStacks was invoked using root credentials. type: Policy:IAMUser/RootCredentialUsage updatedAt: 2021-05-12T19:41:31.000000Z }
AWS IAM Access Analyzer	AWS IAM Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity.	Source type: aws:accessanalyzer:finding Example event: { [-] accountId: 55000000000 action: [ [+] ] analyzedAt: 2021-02-04T17:21:23.130Z condition: { [+] } createdAt: 2021-02-04T17:21:23.130Z id: 723cc4fd-97bc-43b8-8932-6889c4070e0e isDeleted: false isPublic: false principal: { [+] } region: us-west-2 resource: arn:aws:iam::55000000000:role/SplunkDMStackSetExecutionRole resourceType: AWS::IAM::Role status: ACTIVE updatedAt: 2021-02-04T17:21:23.130Z version: 1.0 }
AWS IAM Credential Report	AWS IAM Credential Report lists all users in your account and the status of their various credentials, including passwords, access keys, and MFA devices.	Source type: aws:iam:credentialreport Example event: { [-] access_key_1_active: false access_key_1_last_rotated: N/A access_key_1_last_used_date: N/A access_key_1_last_used_region: N/A access_key_1_last_used_service: N/A access_key_2_active: false access_key_2_last_rotated: N/A access_key_2_last_used_date: N/A access_key_2_last_used_region: N/A access_key_2_last_used_service: N/A account_id: 45000000000 arn: arn:aws:iam::45000000000:root cert_1_active: false cert_1_last_rotated: N/A cert_2_active: false cert_2_last_rotated: N/A SplunkDM_aws_configid: d8b11c12-6707-11eb-95ab-02cbcd7b93b9 mfa_active: true password_enabled: not_supported password_last_changed: not_supported password_last_used: 2020-12-09T21:15:59+00:00 password_next_rotation: not_supported user: <root_account> user_creation_time: 2020-09-12T15:48:42+00:00 }
AWS Lambda	AWS Lambda is a compute service that lets you run code without provisioning or managing servers.	Source type: aws:cloudwatchlogs Example event: { [-] additionalEventData: { [+] } awsRegion: us-east-1 eventCategory: Management eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef eventName: GetBucketAcl eventSource: s3.amazonaws.com eventTime: 2021-05-12T23:09:48Z eventType: AwsApiCall eventVersion: 1.08 managementEvent: true readOnly: true recipientAccountId: 486996137179 requestID: B9V4WAKPAR6Q0M20 requestParameters: { [+] } resources: [ [+] ] responseElements: null sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f sourceIPAddress: cloudtrail.amazonaws.com userAgent: cloudtrail.amazonaws.com userIdentity: { [+] } }
Metadata	Metadata is data about your instance that you can use to configure or manage items such as EC2 Instances, IAM Roles, and Security Groups.	Source type: aws:metadata Example event: { [-] AccountId: 486996137179 Associations: [ [+] ] Entries: [ [+] ] IsDefault: true NetworkAclId: acl-ccf682a7 OwnerId: 486996137179 Region: us-east-2 Tags: [ [+] ] VpcId: vpc-9cb73ef7 SplunkDM_input_id: f992eedc-e815-4eaf-998f-894a994719ac }
Amazon RDS	Amazon RDS is a web service that allows users to set up, operate, and scale a relational database in the cloud.	Source type: aws:cloudwatchlogs Example event: { [-] additionalEventData: { [+] } awsRegion: us-east-1 eventCategory: Management eventID: a41227dd-c5d0-45f3-8fb3-40fba334a6ef eventName: GetBucketAcl eventSource: s3.amazonaws.com eventTime: 2021-05-12T23:09:48Z eventType: AwsApiCall eventVersion: 1.08 managementEvent: true readOnly: true recipientAccountId: 486996137179 requestID: B9V4WAKPAR6Q0M20 requestParameters: { [+] } resources: [ [+] ] responseElements: null sharedEventID: 0b5a110a-4364-461f-8472-709e2cc67a8f sourceIPAddress: cloudtrail.amazonaws.com userAgent: cloudtrail.amazonaws.com userIdentity: { [+] } }
AWS Security Hub	AWS Security Hub gives you a comprehensive view of your security alerts and security posture across your AWS accounts.	Source type: aws:securityhub:finding Example event: { [-] AwsAccountId: 986546787665 CreatedAt: 2021-05-12T19:40:31.000000Z Description: API ListStacks was invoked using root credentials from IP address 99.37.245.87. FirstObservedAt: 2021-05-12T19:40:31Z GeneratorId: arn:aws:guardduty:us-west-1:264962456697:detector/66b954920ec49f3fb2b48aac9f4dfe55 Id: arn:aws:guardduty:us-west-1:264962456697:detector/66b954920ec49f3fb2b48aac9f4dfe55/finding/48b9761c3553de180eeae02247363b8d LastObservedAt: 2021-05-12T19:40:31Z ProductArn: arn:aws:securityhub:us-west-1::product/aws/guardduty ProductFields: { [+] } RecordState: ACTIVE Resources: [ [+] ] SchemaVersion: 2018-10-08 Severity: { [+] } SourceUrl: https://us-west-1.console.aws.amazon.com/guardduty/home?region=us-west-1#/findings?macros=current&fId=48b9761c3553de180eeae02247363b8d Title: API ListStacks was invoked using root credentials. Types: [ [+] ] UpdatedAt: 2021-05-12T19:40:31.000000Z Workflow: { [+] } WorkflowState: NEW }

Getting data in for Microsoft Azure

You can get data in for the following Microsoft Azure data sources.

Data Source	Description	Source Type and Example Event
Azure Active Directory	Azure Active Directory is a cloud computing service created by Microsoft for building, testing, deploying, and managing applications and services through Microsoft-managed data centers.	Source type: azure:monitor:aad Example event: { [-] Level: 4 callerIpAddress: 52.43.55.129 category: ServicePrincipalSignInLogs correlationId: 17b0805a-13f0-4800-a81a-d1ea2d1a9921 data_manager_input_id: 089a37ba-59f3-450a-9201-e8aa9032027e durationMs: 0 location: US operationName: Sign-in activity operationVersion: 1.0 properties: { [+] } resourceId: /tenants/501792f2-ef2c-4251-957b-293fadb63ddc/providers/Microsoft.aadiam resultSignature: None resultType: 0 tenantId: 501792f2-ef2c-4251-957b-293fadb63ddc time: 2021-09-18T18:00:09.4379696Z
Azure Activity Logs	Azure Activity Log is a platform log in Azure that provides insight into subscription-level events. This includes such information as when a resource is modified or when a virtual machine is started.	Source type: azure:monitor:activity Example event: { [-] ReleaseVersion: 6.2021.41.6+f1cf8a2.release_2021w41 RoleLocation: East US callerIpAddress: 20.42.74.11 category: Administrative correlationId: 804f69ae-aedb-499f-9e13-1157121456b4 durationMs: 69 identity: { [+] } level: Information operationName: MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTACCOUNTSAS/ACTION properties: { [+] } resourceId: /SUBSCRIPTIONS/C83C2282-2E21-4F64-86AE-FDFA66B673EB/RESOURCEGROUPS/SIMON-DEMO/PROVIDERS/MICROSOFT.STORAGE/STORAGEACCOUNTS/DSPCDCSIMONTEST resultSignature: Succeeded.OK resultType: Success tenantId: 501792f2-ef2c-4251-957b-293fadb63ddc time: 2021-10-21T17:36:11.2611638Z }