CIM definition for dest_host and dest_name is missing

[asieira]

I was reading the CIM Network Traffic data model definition and found this in the description of the dest field:

The destination of the network traffic (the remote host). You can alias this from more specific fields, such as dest_host, dest_ip, or    dest_name.

The fields dest_host and dest_name are used throughout the models, but are never actually defined anywhere. Are they the same thing, or different things? Can NetBIOS names be used, or only DNS FQDNs? Is the reverse DNS resolution of the destination IP address by a firewall accepted, or only the actual domain that was resolved by the endpoint to perform that network communication?

Without clear answers for all of those questions, it's really hard to be able to use these fields.

[jcoates_splunk · Accepted solution]

Hi,

I think this is a documentation issue and that dest_nt_host and dest_fqdn_name are the intended fields. dest_host and dest_name don't appear to actually have any functional declaration in the CIM package. We'll follow up on it, thanks.

-bash-4.1$ cd splunk/etc/apps/Splunk_SA_CIM/default/data/
-bash-4.1$ find models/ -name *.json | xargs grep dest | grep host
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
models/Network_Sessions.json:                   "calculationID":    "All_Sessions_fillnull_dest_nt_host",
models/Network_Sessions.json:                           "fieldName":    "dest_nt_host",
models/Network_Sessions.json:                           "displayName":  "dest_nt_host",
models/Network_Sessions.json:                   "expression":       "if(isnull(dest_nt_host) OR dest_nt_host=\"\",\"unknown\",dest_nt_host)"
-bash-4.1$ 
-bash-4.1$ find models/ -name *.json | xargs grep dest_host
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
-bash-4.1$ 
-bash-4.1$ 
-bash-4.1$ find models/ -name *.json | xargs grep dest | grep name
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
models/Splunk_CIM_Validation.json:                  "search":   "All_Changes.is_Endpoint_Changes=1 AND (object_category=file OR object_category=directory) AND (action=\"unknown\" OR dest=\"unknown\" OR object=\"unknown\" OR object_category=\"unknown\" OR object_path=\"unknown\" OR status=\"unknown\" OR user=\"unknown\" OR file_access_time=0 OR file_create_time=0 OR file_hash=\"unknown\" OR file_modify_time=0 OR file_name=\"unknown\" OR file_path=\"unknown\" OR file_acl=\"unknown\" OR file_size=\"unknown\")"
models/Splunk_CIM_Validation.json:                  "search": "All_Inventory.is_Network=1 AND (dest=\"unknown\" OR NOT (interface=* OR ip=* OR mac=* OR name=* OR dns=*))"
-bash-4.1$ 
-bash-4.1$ find models/ -name *.json | xargs grep dest_name
models/Alerts.json:                         "comment":      "The asset or identity that the alert event is about. May be aliased from more specific fields, such as dest_host, dest_ip, or dest_name. Also see the optional dest_* fields listed in Optional Subject Fields.",
-bash-4.1$ 

[misharox]

Hi,

It is 2021 and I still could not find any definition for `dest_host`, `dest_ip` or `dest_name` in the documentation. Specifically, I'm looking at https://docs.splunk.com/Documentation/CIM/4.18.0/User/Vulnerabilities

Any chance these could be documented, please?

Thanks,

Misha

[asieira]

Please note that dest_nt_host and dest_fqdn_name are not defined on the Network Traffic model either. So if you do update the documentation of dest to reference them, please make sure they are defined appropriately.