Knowledge Management

What is the difference between CIM malware attacks and Operations?

HiroshiSatoh
Champion

It corresponds to CIM, but there is a model that I do not understand well.
What is the CIM Malware Operation? Can you explain in detail?

0 Karma
1 Solution

lakshman239
SplunkTrust
SplunkTrust

Malware operations is about events/activities relating to 'scan', 'AV updates', scan started, scan completed etc.. that are not related to detecting an attack [ e.g. virus/malware/threat detected - they usually have a signature]. These events are to have tags : Malware, Operations as per data models.

View solution in original post

lakshman239
SplunkTrust
SplunkTrust

Malware operations is about events/activities relating to 'scan', 'AV updates', scan started, scan completed etc.. that are not related to detecting an attack [ e.g. virus/malware/threat detected - they usually have a signature]. These events are to have tags : Malware, Operations as per data models.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...