際際滷

際際滷Share a Scribd company logo
CIM compliance
By Matt Feeley
Copyright 息2023 | guidepointsecurity.com
How to see it
Practice of normalizing fields to a common
standard like,
 source_host, source_ip, source -> src
 vendor_action, measure, result -> action
 known_auth, etc.. -> signature
across data sources like,
 Windows
 Linux
 Palo, etc..
within events of matching domains (23)
 Authentication
 Malware
 Intrusion detection, etc..
Copyright 息2023 | guidepointsecurity.com
How do you say it?
Toe揃ma揃tow
Tuh揃may揃tow
Tomato
Copyright 息2023 | guidepointsecurity.com
Copyright 息2023 | guidepointsecurity.com
Copyright 息2023 | guidepointsecurity.com
 Searches Itself
 Syntax change datamodels, tstats, etc..
 No (index=*) OR (index=win AND index=o365)
 Faster results (saved different on backend)
 Search returns all events per datamodel (regardless of data source)
Why Do CIM?
Copyright 息2023 | guidepointsecurity.com
End Result
Copyright 息2023 | guidepointsecurity.com
Steps Involved
D E F I N I N G
1. Pre-requistes
1. Install CIM app
2. Identify & Define
1. Identify events to a domain
2. Define eventtypes & tags for event
3. Normalize
1. Review fields
2. Standardize the fields
4. Validate & Complete
1. Validate Check for adverse affects (like
overwriting, existing fields)
2. Setup Common Information Model app
3. Rebuild/Update Datamodel
Copyright 息2023 | guidepointsecurity.com
Install CIM App
 You can find the free app on
splunkbase
 The CIM app provides the framework
of datamodels.
Copyright 息2023 | guidepointsecurity.com
I D E N T I F Y E V E N T S T O A D O M A I N
 Domains have a constraint
events must meet
 No tag field exists
Copyright 息2023 | guidepointsecurity.com
D E F I N E E V E N T T Y P E S A N D T A G S
 Search string should be as restrictive
as possible to only show events of
interest
 Tag(s) should contain the required
constraint for datamodel of intersest
Copyright 息2023 | guidepointsecurity.com
Copyright 息2023 | guidepointsecurity.com
Review Fields
 Use best judgement
 Dont be afraid to ask Admins of data source to validate
 Every field does NOT need to exist within an event
 Some events might just not contain a field
Copyright 息2023 | guidepointsecurity.com
 Ways to Standardize
1. rename
2. extract
3. report
4. KV_MODE
5. fieldalias
6. eval (also known as fields)
7. lookup
Standardize Fields & Values
Copyright 息2023 | guidepointsecurity.com
 Order of Precedence
1. rename
2. extract
3. report (usually extractions that involve both props.conf
and transforms.conf)
4. KV_MODE
5. fieldalias
6. eval (also known as fields)
7. lookup
Validate and Check
 Eval method overwriting lookup method for the
fields value
 Youll need to validate on Large Volumes of Data
Copyright 息2023 | guidepointsecurity.com
Setup
Common
Information
Model app
Copyright 息2023 | guidepointsecurity.com
Rebuild/Update Datamodel
 Rebuild Could impact existing dashboard(s). Results zero out,
and will re-populate as new events come in.
 Update Wont impact existing dashboard(s)
Copyright 息2023 | guidepointsecurity.com
Things to watch out for
 Set Global Permission on all Knowledge Objects
 Evals, Extractions, Eventtypes, Tags, etc..
 Always validate pre-existing fields/events work
as expected.
 Knowledge object order of precedence can over
wright other knowledge objects.
1. rename
2. extract
3. report (usually extractions that involve both
props.conf and transforms.conf)
4. KV_MODE
5. fieldalias
6. eval (also known as fields)
7. calculated
8. lookup
PAY ATTENTION!!!
 Attempt to use add-ons from splunkbase.
 Potentially already CIM comply
 The better quality the add-on the less youll need to
do thats custom.
 You should always review and CIM even if add-on
parses accurate
 Rebuild/Update datamodels at any point additional
CIM compliance is done
 Every event will NOT contain every field to
standardize
 Some fields require certain values for output
Ad

Recommended

Splunk live! ninjas_break-out
Splunk live! ninjas_break-out
Splunk
Pragmatic Patterns (and Pitfalls) for Event Streaming in Brownfield Environme...
Pragmatic Patterns (and Pitfalls) for Event Streaming in Brownfield Environme...
HostedbyConfluent
Data Onboarding Breakout Session
Data Onboarding Breakout Session
Splunk
Using a Data Model to Bridge the Mainframe-Splunk Knowledge Gap
Using a Data Model to Bridge the Mainframe-Splunk Knowledge Gap
Precisely
Tech Talk SQL Server 2012 Business Intelligence
Tech Talk SQL Server 2012 Business Intelligence
Ray Cochrane
DataPreprocessing.ppt
DataPreprocessing.ppt
TesfahunAsmare1
Data preparation and processing chapter 2
Data preparation and processing chapter 2
Mahmoud Alfarra
MISTI Infosec 2010- SIEM Implementation
MISTI Infosec 2010- SIEM Implementation
Michael Nickle
fundamentalsofeventdrivenmicroservices11728489736099.pdf
fundamentalsofeventdrivenmicroservices11728489736099.pdf
Smarak Pani
Data processing
Data processing
akanshagoyal1989
Cyber Threat Ranking using READ
Cyber Threat Ranking using READ
Zachary S. Brown
Sql Server 2012
Sql Server 2012
Performics.Convonix
Mitigating One Million Security Threats With Kafka and Spark With Arun Janart...
Mitigating One Million Security Threats With Kafka and Spark With Arun Janart...
HostedbyConfluent
Apache Spark for Cyber Security in an Enterprise Company
Apache Spark for Cyber Security in an Enterprise Company
Databricks
Data Science presentation for explanation of numpy and pandas
Data Science presentation for explanation of numpy and pandas
spmf313
Apply big data and data lake for processing security data collections
Apply big data and data lake for processing security data collections
Gregory Shlyuger
1Chapter_ Two_ 2 Data Preparation lecture note.pptx
1Chapter_ Two_ 2 Data Preparation lecture note.pptx
fikadumeuedu
Intro to Data warehousing lecture 10
Intro to Data warehousing lecture 10
AnwarrChaudary
SplunkLive! Presentation - Data Onboarding with Splunk
SplunkLive! Presentation - Data Onboarding with Splunk
Splunk
3-DataPreprocessing a complete guide.pdf
3-DataPreprocessing a complete guide.pdf
shobyscms
Understanding event data
Understanding event data
yalisassoon
ServiceNow CIS-ITSM Exam Dumps & Questions [2024]
ServiceNow CIS-ITSM Exam Dumps & Questions [2024]
SkillCertProExams
Real-Time Streaming: Move IMS Data to Your Cloud Data Warehouse
Real-Time Streaming: Move IMS Data to Your Cloud Data Warehouse
Precisely
Data Governance Goal Framework Alignment.pptx
Data Governance Goal Framework Alignment.pptx
simha11771
Data Preprocessing
Data Preprocessing
T Kavitha
Chapter 2 Cond (1).ppt
Chapter 2 Cond (1).ppt
kannaradhas
Data Management Workshop - ETOT 2016
Data Management Workshop - ETOT 2016
DataGenic Ltd
Data Preprocessing in Data Mining Lecture 際際滷
Data Preprocessing in Data Mining Lecture 際際滷
Nehal668249
Salesforce Summer '25 Release Frenchgathering.pptx.pdf
Salesforce Summer '25 Release Frenchgathering.pptx.pdf
yosra Saidani
A Constitutional Quagmire - Ethical Minefields of AI, Cyber, and Privacy.pdf
A Constitutional Quagmire - Ethical Minefields of AI, Cyber, and Privacy.pdf
Priyanka Aash

More Related Content

Similar to CIM Compliance.pptx (20)

fundamentalsofeventdrivenmicroservices11728489736099.pdf
fundamentalsofeventdrivenmicroservices11728489736099.pdf
Smarak Pani
Data processing
Data processing
akanshagoyal1989
Cyber Threat Ranking using READ
Cyber Threat Ranking using READ
Zachary S. Brown
Sql Server 2012
Sql Server 2012
Performics.Convonix
Mitigating One Million Security Threats With Kafka and Spark With Arun Janart...
Mitigating One Million Security Threats With Kafka and Spark With Arun Janart...
HostedbyConfluent
Apache Spark for Cyber Security in an Enterprise Company
Apache Spark for Cyber Security in an Enterprise Company
Databricks
Data Science presentation for explanation of numpy and pandas
Data Science presentation for explanation of numpy and pandas
spmf313
Apply big data and data lake for processing security data collections
Apply big data and data lake for processing security data collections
Gregory Shlyuger
1Chapter_ Two_ 2 Data Preparation lecture note.pptx
1Chapter_ Two_ 2 Data Preparation lecture note.pptx
fikadumeuedu
Intro to Data warehousing lecture 10
Intro to Data warehousing lecture 10
AnwarrChaudary
SplunkLive! Presentation - Data Onboarding with Splunk
SplunkLive! Presentation - Data Onboarding with Splunk
Splunk
3-DataPreprocessing a complete guide.pdf
3-DataPreprocessing a complete guide.pdf
shobyscms
Understanding event data
Understanding event data
yalisassoon
ServiceNow CIS-ITSM Exam Dumps & Questions [2024]
ServiceNow CIS-ITSM Exam Dumps & Questions [2024]
SkillCertProExams
Real-Time Streaming: Move IMS Data to Your Cloud Data Warehouse
Real-Time Streaming: Move IMS Data to Your Cloud Data Warehouse
Precisely
Data Governance Goal Framework Alignment.pptx
Data Governance Goal Framework Alignment.pptx
simha11771
Data Preprocessing
Data Preprocessing
T Kavitha
Chapter 2 Cond (1).ppt
Chapter 2 Cond (1).ppt
kannaradhas
Data Management Workshop - ETOT 2016
Data Management Workshop - ETOT 2016
DataGenic Ltd
Data Preprocessing in Data Mining Lecture 際際滷
Data Preprocessing in Data Mining Lecture 際際滷
Nehal668249
fundamentalsofeventdrivenmicroservices11728489736099.pdf
fundamentalsofeventdrivenmicroservices11728489736099.pdf
Smarak Pani
Cyber Threat Ranking using READ
Cyber Threat Ranking using READ
Zachary S. Brown
Mitigating One Million Security Threats With Kafka and Spark With Arun Janart...
Mitigating One Million Security Threats With Kafka and Spark With Arun Janart...
HostedbyConfluent
Apache Spark for Cyber Security in an Enterprise Company
Apache Spark for Cyber Security in an Enterprise Company
Databricks
Data Science presentation for explanation of numpy and pandas
Data Science presentation for explanation of numpy and pandas
spmf313
Apply big data and data lake for processing security data collections
Apply big data and data lake for processing security data collections
Gregory Shlyuger
1Chapter_ Two_ 2 Data Preparation lecture note.pptx
1Chapter_ Two_ 2 Data Preparation lecture note.pptx
fikadumeuedu
Intro to Data warehousing lecture 10
Intro to Data warehousing lecture 10
AnwarrChaudary
SplunkLive! Presentation - Data Onboarding with Splunk
SplunkLive! Presentation - Data Onboarding with Splunk
Splunk
3-DataPreprocessing a complete guide.pdf
3-DataPreprocessing a complete guide.pdf
shobyscms
Understanding event data
Understanding event data
yalisassoon
ServiceNow CIS-ITSM Exam Dumps & Questions [2024]
ServiceNow CIS-ITSM Exam Dumps & Questions [2024]
SkillCertProExams
Real-Time Streaming: Move IMS Data to Your Cloud Data Warehouse
Real-Time Streaming: Move IMS Data to Your Cloud Data Warehouse
Precisely
Data Governance Goal Framework Alignment.pptx
Data Governance Goal Framework Alignment.pptx
simha11771
Data Preprocessing
Data Preprocessing
T Kavitha
Chapter 2 Cond (1).ppt
Chapter 2 Cond (1).ppt
kannaradhas
Data Management Workshop - ETOT 2016
Data Management Workshop - ETOT 2016
DataGenic Ltd
Data Preprocessing in Data Mining Lecture 際際滷
Data Preprocessing in Data Mining Lecture 際際滷
Nehal668249

Recently uploaded (20)

Salesforce Summer '25 Release Frenchgathering.pptx.pdf
Salesforce Summer '25 Release Frenchgathering.pptx.pdf
yosra Saidani
A Constitutional Quagmire - Ethical Minefields of AI, Cyber, and Privacy.pdf
A Constitutional Quagmire - Ethical Minefields of AI, Cyber, and Privacy.pdf
Priyanka Aash
PyCon SG 25 - Firecracker Made Easy with Python.pdf
PyCon SG 25 - Firecracker Made Easy with Python.pdf
Muhammad Yuga Nugraha
CapCut Pro Crack For PC Latest Version {Fully Unlocked} 2025
CapCut Pro Crack For PC Latest Version {Fully Unlocked} 2025
pcprocore
AI VIDEO MAGAZINE - June 2025 - r/aivideo
AI VIDEO MAGAZINE - June 2025 - r/aivideo
1pcity Studios, Inc
Oh, the Possibilities - Balancing Innovation and Risk with Generative AI.pdf
Oh, the Possibilities - Balancing Innovation and Risk with Generative AI.pdf
Priyanka Aash
OpenPOWER Foundation & Open-Source Core Innovations
OpenPOWER Foundation & Open-Source Core Innovations
IBM
GenAI Opportunities and Challenges - Where 370 Enterprises Are Focusing Now.pdf
GenAI Opportunities and Challenges - Where 370 Enterprises Are Focusing Now.pdf
Priyanka Aash
cnc-processing-centers-centateq-p-110-en.pdf
cnc-processing-centers-centateq-p-110-en.pdf
AmirStern2
Cyber Defense Matrix Workshop - RSA Conference
Cyber Defense Matrix Workshop - RSA Conference
Priyanka Aash
Connecting Data and Intelligence: The Role of FME in Machine Learning
Connecting Data and Intelligence: The Role of FME in Machine Learning
Safe Software
9-1-1 Addressing: End-to-End Automation Using FME
9-1-1 Addressing: End-to-End Automation Using FME
Safe Software
2025_06_18 - OpenMetadata Community Meeting.pdf
2025_06_18 - OpenMetadata Community Meeting.pdf
OpenMetadata
UserCon Belgium: Honey, VMware increased my bill
UserCon Belgium: Honey, VMware increased my bill
stijn40
Lessons Learned from Developing Secure AI Workflows.pdf
Lessons Learned from Developing Secure AI Workflows.pdf
Priyanka Aash
AI Agents and FME: A How-to Guide on Generating Synthetic Metadata
AI Agents and FME: A How-to Guide on Generating Synthetic Metadata
Safe Software
OpenACC and Open Hackathons Monthly Highlights June 2025
OpenACC and Open Hackathons Monthly Highlights June 2025
OpenACC
ReSTIR [DI]: Spatiotemporal reservoir resampling for real-time ray tracing ...
ReSTIR [DI]: Spatiotemporal reservoir resampling for real-time ray tracing ...
revolcs10
Smarter Aviation Data Management: Lessons from Swedavia Airports and Sweco
Smarter Aviation Data Management: Lessons from Swedavia Airports and Sweco
Safe Software
AI vs Human Writing: Can You Tell the Difference?
AI vs Human Writing: Can You Tell the Difference?
Shashi Sathyanarayana, Ph.D
Salesforce Summer '25 Release Frenchgathering.pptx.pdf
Salesforce Summer '25 Release Frenchgathering.pptx.pdf
yosra Saidani
A Constitutional Quagmire - Ethical Minefields of AI, Cyber, and Privacy.pdf
A Constitutional Quagmire - Ethical Minefields of AI, Cyber, and Privacy.pdf
Priyanka Aash
PyCon SG 25 - Firecracker Made Easy with Python.pdf
PyCon SG 25 - Firecracker Made Easy with Python.pdf
Muhammad Yuga Nugraha
CapCut Pro Crack For PC Latest Version {Fully Unlocked} 2025
CapCut Pro Crack For PC Latest Version {Fully Unlocked} 2025
pcprocore
AI VIDEO MAGAZINE - June 2025 - r/aivideo
AI VIDEO MAGAZINE - June 2025 - r/aivideo
1pcity Studios, Inc
Oh, the Possibilities - Balancing Innovation and Risk with Generative AI.pdf
Oh, the Possibilities - Balancing Innovation and Risk with Generative AI.pdf
Priyanka Aash
OpenPOWER Foundation & Open-Source Core Innovations
OpenPOWER Foundation & Open-Source Core Innovations
IBM
GenAI Opportunities and Challenges - Where 370 Enterprises Are Focusing Now.pdf
GenAI Opportunities and Challenges - Where 370 Enterprises Are Focusing Now.pdf
Priyanka Aash
cnc-processing-centers-centateq-p-110-en.pdf
cnc-processing-centers-centateq-p-110-en.pdf
AmirStern2
Cyber Defense Matrix Workshop - RSA Conference
Cyber Defense Matrix Workshop - RSA Conference
Priyanka Aash
Connecting Data and Intelligence: The Role of FME in Machine Learning
Connecting Data and Intelligence: The Role of FME in Machine Learning
Safe Software
9-1-1 Addressing: End-to-End Automation Using FME
9-1-1 Addressing: End-to-End Automation Using FME
Safe Software
2025_06_18 - OpenMetadata Community Meeting.pdf
2025_06_18 - OpenMetadata Community Meeting.pdf
OpenMetadata
UserCon Belgium: Honey, VMware increased my bill
UserCon Belgium: Honey, VMware increased my bill
stijn40
Lessons Learned from Developing Secure AI Workflows.pdf
Lessons Learned from Developing Secure AI Workflows.pdf
Priyanka Aash
AI Agents and FME: A How-to Guide on Generating Synthetic Metadata
AI Agents and FME: A How-to Guide on Generating Synthetic Metadata
Safe Software
OpenACC and Open Hackathons Monthly Highlights June 2025
OpenACC and Open Hackathons Monthly Highlights June 2025
OpenACC
ReSTIR [DI]: Spatiotemporal reservoir resampling for real-time ray tracing ...
ReSTIR [DI]: Spatiotemporal reservoir resampling for real-time ray tracing ...
revolcs10
Smarter Aviation Data Management: Lessons from Swedavia Airports and Sweco
Smarter Aviation Data Management: Lessons from Swedavia Airports and Sweco
Safe Software
AI vs Human Writing: Can You Tell the Difference?
AI vs Human Writing: Can You Tell the Difference?
Shashi Sathyanarayana, Ph.D
Ad

CIM Compliance.pptx

  • 2. Copyright 息2023 | guidepointsecurity.com How to see it Practice of normalizing fields to a common standard like, source_host, source_ip, source -> src vendor_action, measure, result -> action known_auth, etc.. -> signature across data sources like, Windows Linux Palo, etc.. within events of matching domains (23) Authentication Malware Intrusion detection, etc..
  • 3. Copyright 息2023 | guidepointsecurity.com How do you say it? Toe揃ma揃tow Tuh揃may揃tow Tomato
  • 4. Copyright 息2023 | guidepointsecurity.com
  • 5. Copyright 息2023 | guidepointsecurity.com
  • 6. Copyright 息2023 | guidepointsecurity.com Searches Itself Syntax change datamodels, tstats, etc.. No (index=*) OR (index=win AND index=o365) Faster results (saved different on backend) Search returns all events per datamodel (regardless of data source) Why Do CIM?
  • 7. Copyright 息2023 | guidepointsecurity.com End Result
  • 8. Copyright 息2023 | guidepointsecurity.com Steps Involved D E F I N I N G 1. Pre-requistes 1. Install CIM app 2. Identify & Define 1. Identify events to a domain 2. Define eventtypes & tags for event 3. Normalize 1. Review fields 2. Standardize the fields 4. Validate & Complete 1. Validate Check for adverse affects (like overwriting, existing fields) 2. Setup Common Information Model app 3. Rebuild/Update Datamodel
  • 9. Copyright 息2023 | guidepointsecurity.com Install CIM App You can find the free app on splunkbase The CIM app provides the framework of datamodels.
  • 10. Copyright 息2023 | guidepointsecurity.com I D E N T I F Y E V E N T S T O A D O M A I N Domains have a constraint events must meet No tag field exists
  • 11. Copyright 息2023 | guidepointsecurity.com D E F I N E E V E N T T Y P E S A N D T A G S Search string should be as restrictive as possible to only show events of interest Tag(s) should contain the required constraint for datamodel of intersest
  • 12. Copyright 息2023 | guidepointsecurity.com
  • 13. Copyright 息2023 | guidepointsecurity.com Review Fields Use best judgement Dont be afraid to ask Admins of data source to validate Every field does NOT need to exist within an event Some events might just not contain a field
  • 14. Copyright 息2023 | guidepointsecurity.com Ways to Standardize 1. rename 2. extract 3. report 4. KV_MODE 5. fieldalias 6. eval (also known as fields) 7. lookup Standardize Fields & Values
  • 15. Copyright 息2023 | guidepointsecurity.com Order of Precedence 1. rename 2. extract 3. report (usually extractions that involve both props.conf and transforms.conf) 4. KV_MODE 5. fieldalias 6. eval (also known as fields) 7. lookup Validate and Check Eval method overwriting lookup method for the fields value Youll need to validate on Large Volumes of Data
  • 16. Copyright 息2023 | guidepointsecurity.com Setup Common Information Model app
  • 17. Copyright 息2023 | guidepointsecurity.com Rebuild/Update Datamodel Rebuild Could impact existing dashboard(s). Results zero out, and will re-populate as new events come in. Update Wont impact existing dashboard(s)
  • 18. Copyright 息2023 | guidepointsecurity.com Things to watch out for Set Global Permission on all Knowledge Objects Evals, Extractions, Eventtypes, Tags, etc.. Always validate pre-existing fields/events work as expected. Knowledge object order of precedence can over wright other knowledge objects. 1. rename 2. extract 3. report (usually extractions that involve both props.conf and transforms.conf) 4. KV_MODE 5. fieldalias 6. eval (also known as fields) 7. calculated 8. lookup PAY ATTENTION!!! Attempt to use add-ons from splunkbase. Potentially already CIM comply The better quality the add-on the less youll need to do thats custom. You should always review and CIM even if add-on parses accurate Rebuild/Update datamodels at any point additional CIM compliance is done Every event will NOT contain every field to standardize Some fields require certain values for output