Getting Data In

Intrusion Detection data model: Is host not really a tag, but treated as such with regard to the data model?

tmkunte
Engager

This is more of question for my understanding...

In the examples section of CIM Add-on manual (for OSSEC) there is a statement that the Intrusion Detection data model requires the tags ids, attack, and host

If you look at the intrusion detection data model, the constraint is ids_type="host"

So host is not really a tag, but it is treated as such with regards to the data model?

thanks

rpille_splunk
Splunk Employee
Splunk Employee

tmkunte -- thanks for pointing this out. That is a docs bug. We should only be referring to ids and attack as tags. The additional constraint for a host intrusion detection is the presence of that ids_type field with a value of host, as you point out. We'll get it fixed!

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...