CIM Toolkit for Splunk Supporting Common Information Model Add-on
Overview
This app also contains a set of macros to greatly increase the flexibility and accuracy of SIEM drilldowns (there is an example correlation search that demonstrates this).
This app and the slide deck referenced below were developed independently, but there is a great deal of common concepts and overlap so it is a perfect primer:
https://foren6.files.wordpress.com/2020/12/splunk-es-correlation-searches-best-practices-v1.0-rev2.pdf
Release Notes
Version 1.2.8
Removed hard-coded "en-US" which, it turns out, is not necessary.
Added new search to help debug ES asset/identity problem.
Modified search names to add security domain prefix values to each.
Version 1.2.7
Fixed missing "=" char in transforms.conf.
App now passes appinspect for cloud again!
NOTE: The stuff in props.conf doesn't work and I am not sure why.
The splunk-produced stuff for Splunk Authentication events in the "_audit" index has many problems, not the least of which is that it automatically parses the SPL that is logged (because of KV_MODE=auto) and pollutes your event with fake KVPs. This is an even more important problem because if your search has something like "tag=authentication" then these events will be incorrectly pulled into your DMAs! I actually built a proper RegularExpression but Splunk refuses to run it properly no matter what I try.