Protocols that map to Splunk CIM
The Splunk Common Information Model (CIM) provides data models that help you build searches of event data. Splunk data models generate search strings based on the data model objects and fields that you specify. Splunk App for Stream supports several protocols that map directly to the Splunk CIM.
Splunk App for Stream supports the following data models in Splunk_SA_CIM
:
Authentication
Object name(s)
|
Field name
|
Data type
|
Description
|
Authentication
|
user
|
string
|
Generic name for the class of the updated resource object. Expected values may be specific to an App.
|
Change Analysis
XMPP
Object name(s)
|
Field name
|
Data type
|
Description
|
All_Changes
|
object_category
|
string
|
Generic name for the class of the updated resource object. Expected values may be specific to an App.
|
Filesystem_Changes
|
file_name
|
string
|
The name of the file that is the object of the event (without location information related to local file or directory structure).
|
Filesystem_Changes
|
file_access_time
|
string
|
The time the file (the object of the event) was accessed.
|
Filesystem_Changes
|
file_hash
|
string
|
A cryptographic identifier assigned to the file object affected by the event.
|
Filesystem_Changes
|
file_size
|
string
|
The size of the file that is the object of the event, in kilobytes.
|
Certificates
TCP
Object name(s)
|
Field name
|
Data type
|
Description
|
All_Certificates
|
dest
|
string
|
The target in the certificate management event.
|
All_Certificates
|
duration
|
number
|
The amount of time for the completion of the certificate management event, in seconds.
|
All_Certificates
|
response_time
|
number
|
The amount of time it took to receive a response in the certificate management event, if applicable.
|
All_Certificates
|
src
|
string
|
The source involved in the certificate management event. May be aliased from more specific fields, such as src_host, src_ip, or src_nt_host.
|
All_Certificates
|
transport
|
string
|
The transport protocol of the Network Traffic involved with this certificate.
|
SSL
|
ssl_end_time
|
string
|
The expiration time of the certificate.
|
SSL
|
ssl_hash
|
string
|
The certificate hash.
|
SSL
|
ssl_issuer
|
string
|
The certificate issuer's RFC2253 Distinguished Name.
|
SSL
|
ssl_issuer_common_name
|
string
|
The certificate issuer common name.
|
SSL
|
ssl_issuer_email
|
string
|
The certificate issuer email address.
|
SSL
|
ssl_issuer_locality
|
string
|
The certificate issuer locality.
|
SSL
|
ssl_issuer_organization
|
string
|
The certificate issuer organization.
|
SSL
|
ssl_issuer_state
|
string
|
The certificate issuer state of residence.
|
SSL
|
ssl_issuer_street
|
string
|
The certificate issuer street address.
|
SSL
|
ssl_issuer_unit
|
string
|
The certificate issuer organizational unit.
|
SSL
|
ssl_serial
|
string
|
The certificate serial number.
|
SSL
|
ssl_session_id
|
string
|
The session identifier for this certificate.
|
SSL
|
ssl_start_time
|
string
|
This is the start date and time for this certificate's validity.
|
SSL
|
ssl_subject
|
string
|
The certificate owner RFC2253 Distinguished Name.
|
SSL
|
ssl_subject_common_name
|
string
|
This certificate owner common name.
|
SSL
|
ssl_subject_email
|
string
|
The certificate owner e-mail address.
|
SSL
|
ssl_subject_locality
|
string
|
The certificate owner locality.
|
SSL
|
ssl_subject_state
|
string
|
The certificate owner state of residence.
|
SSL
|
ssl_subject_street
|
string
|
The certificate owner street address.
|
SSL
|
ssl_subject_unit
|
string
|
The certificate owner organizational unit.
|
SSL
|
ssl_version
|
string
|
The SSL version of this certificate.
|
Databases
Splunk App for Stream supports these objects and fields in the Databases data model for MySQL, PostgreSQL, Sybase TDS, and Oracle TNS:
Object name(s)
|
Field name
|
Data type
|
Description
|
All_Databases
|
user
|
string
|
The Name of the database process user.
|
All_Databases
|
object
|
string
|
The name of the database object.
|
Database_instance
|
instance_name
|
string
|
The name of the database_instance
|
Database_instance
|
database_version
|
string
|
The version of the database_instance
|
Database_Query
|
query
|
string
|
The database query used for the transaction
|
Database_Query
|
query_time
|
string
|
The time the system initiated the database query
|
Email
Splunk App for Stream supports these objects and fields in the Email data model:
SMTP
Object name(s)
|
Field name
|
Data type
|
Description
|
Possible values
|
All_Email
|
app
|
string
|
|
|
All_Email
|
action
|
string
|
Action taken by the reporting device.
|
delivered , blocked , quarantined , unknown
|
All_Email
|
delay
|
number
|
Total sending delay in seconds.
|
|
All_Email
|
file_name
|
string
|
The name(s) of the file(s) attached to the message, if any exist
|
|
All_Email
|
process
|
string
|
The name of the email executable that carries out the message transaction, such as sendmail , postfix , or the name of an email client
|
|
All_Email
|
protocol
|
string
|
The email protocol involved, such as SMTP or RPC
|
|
All_Email
|
recipient
|
string
|
A field listing individual recipient email addresses, such as recipient="foo@splunk.com" , recipient="bar@splunk.com"
|
|
All_Email
|
recipient_count
|
number
|
The total number of intended message recipients
|
|
All_Email
|
size
|
number
|
The size of the message, in bytes
|
|
All_Email
|
src_user
|
string
|
The email address of the message sender
|
|
All_Email
|
status_code
|
string
|
The status code associated with the message
|
|
POP3
Object name(s)
|
Field name
|
Data type
|
Description
|
Possible values
|
All_Email
|
app
|
string
|
|
|
All_Email
|
action
|
string
|
Action taken by the reporting device
|
delivered , blocked , quarantined , unknown
|
All_Email
|
delay
|
number
|
Total sending delay in seconds
|
|
All_Email
|
file_name
|
string
|
The name(s) of the file(s) attached to the message, if any exist
|
|
All_Email
|
protocol
|
string
|
The email protocol involved, such as SMTP or RPC
|
|
All_Email
|
recipient
|
string
|
A field listing individual recipient email addresses, such as recipient="foo@splunk.com" , recipient="bar@splunk.com"
|
|
All_Email
|
receiver_email
|
string
|
|
|
All_Email
|
size
|
number
|
The size of the message, in bytes
|
|
All_Email
|
src_user
|
string
|
The email address of the message sender
|
|
All_Email
|
status_code
|
string
|
The status code associated with the message
|
|
All_Email
|
user
|
string
|
This is the user context for the process . This is not the email address for the sender, for that, look at the src_user field.
|
|
All_Email
|
orig_src
|
string
|
The original source of the message
|
|
IMAP
Object name(s)
|
Field name
|
Data type
|
Description
|
Possible values
|
All_Email
|
app
|
string
|
|
|
All_Email
|
action
|
string
|
Action taken by the reporting device
|
delivered , blocked , quarantined , unknown
|
All_Email
|
delay
|
number
|
Total sending delay in seconds
|
|
All_Email
|
file_name
|
string
|
The name(s) of the file(s) attached to the message, if any exist
|
|
All_Email
|
process
|
string
|
This is the name of the email executable that carries out the message transaction, such as sendmail , postfix , or the name of an email client.
|
|
All_Email
|
protocol
|
string
|
The email protocol involved, such as SMTP or RPC
|
|
All_Email
|
size
|
number
|
The size of the message, in bytes
|
|
All_Email
|
status_code
|
string
|
The status code associated with the message
|
|
Network Resolution
DNS
Object name(s)
|
Field name
|
Data type
|
Description
|
Possible values
|
DNS
|
answer
|
string
|
Resolved address for the query
|
DNS
|
answer_count
|
string
|
Number of entries in the answer section of the DNS message
|
DNS
|
additional_answer_count
|
string
|
Number of entries in the "additional" section of the DNS message
|
DNS
|
authority_answer_count
|
string
|
Number of entries in the "authority" section of the DNS message
|
DNS
|
query_count
|
string
|
Number of entries that appear in the "Questions" section of the DNS query
|
Network Sessions
DHCP
Object name(s)
|
Field name
|
Data type
|
Description
|
Possible values
|
DHCP
|
lease_duration
|
number
|
The duration of the Dynamic Host Configuration Protocol (DHCP) lease, in seconds
|
Network Traffic
Object name(s)
|
Field name
|
Data type
|
Description
|
Possible values
|
All_Traffic
|
app
|
string
|
The application protocol of the traffic
|
All_Traffic
|
bytes
|
number
|
Total count of bytes handled by this device/interface (bytes_in + bytes_out)
|
All_Traffic
|
bytes_in
|
number
|
How many bytes this device/interface received
|
All_Traffic
|
bytes_out
|
number
|
How many bytes this device/interface transmitted
|
All_Traffic
|
dest
|
string
|
This is the destination of the network traffic (the remote host). This may be aliased from more specific fields, such as dest_host, dest_ip, or dest_name.
|
All_Traffic
|
dest_ip
|
string
|
The IP address of the destination
|
All_Traffic
|
dest_mac
|
string
|
The destination TCP/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14
|
All_Traffic
|
dest_port
|
number
|
The destination port of the network traffic
|
All_Traffic
|
duration
|
string
|
The amount of time for the completion of the network event, in seconds.
|
All_Traffic
|
response_time
|
string
|
The amount of time it took to receive a response in the network event, if applicable
|
All_Traffic
|
src
|
string
|
This is the source of the network traffic (the client requesting the connection). It may be aliased from more specific fields, such as src_host, src_ip, or src_name.
|
All_Traffic
|
src_ip
|
string
|
The iP address of the source
|
All_Traffic
|
src_mac
|
string
|
This is the source TCP/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field.
|
All_Traffic
|
src_port
|
number
|
The source port of the network traffic
|
All_Traffic
|
transport
|
string
|
The OSI layer 4 (transport) protocol of the traffic observed, in lower case
|
All_Traffic
|
user
|
string
|
The user that requested the traffic flow
|
Web
HTTP
Object name(s)
|
Field name
|
Data type
|
Description
|
Possible values
|
Web
|
action
|
string
|
The action taken by the server or proxy
|
Web
|
app
|
string
|
The app recording the data, such as IIS, Squid, or Bluecoat
|
Web
|
bytes
|
number
|
The total number of bytes transferred (bytes_in + bytes_out )
|
Web
|
bytes_in
|
number
|
The number of inbound bytes transferred
|
Web
|
bytes_out
|
number
|
The number of outbound bytes transferred
|
Web
|
cookie
|
string
|
The cookie file recorded in the event
|
Web
|
dest
|
string
|
The destination of the network traffic (the remote host)
|
Web
|
duration
|
number
|
The time taken by the proxy event, in milliseconds
|
Web
|
http_content_type
|
string
|
The content-type of the requested HTTP resource
|
Web
|
http_method
|
string
|
The HTTP method used in the request
|
GET , PUT ,POST , DELETE , etc
|
Web
|
http_referrer
|
string
|
This is the HTTP referrer used in the request. The W3C specification and many implementations misspell this as http_referer . A FIELDALIAS is recommended to handle both key names.
|
Web
|
http_user_agent
|
string
|
The user agent used in the request
|
Web
|
response_time
|
number
|
The amount of time it took to receive a response, if applicable, in milliseconds
|
Web
|
src
|
string
|
The source of the network traffic (the client requesting the connection)
|
Web
|
status
|
string
|
The HTTP response code indicating the status of the proxy request
|
404 , 302 , 500 , and so on
|
Web
|
uri_path
|
string
|
The universal resource indicator path of the resource served by the webserver or proxy
|
Web
|
uri_query
|
string
|
The universal resource indicator path of the resource requested by the client
|
Web
|
url
|
string
|
The URL of the requested HTTP resource
|
Web
|
user
|
string
|
The user that requested the HTTP resource
|
Feedback submitted, thanks!