Splunk Enterprise Security

Issue with CIM Mapping for ES

mustafag
Path Finder

I am receiving the EMail logs from Proofpoint Email gateway via syslog. The single email communication include the multiple logs and we can use the one transaction id to create the full events which include the full email communication details.

As this meaningful event can be generated through correlation of transcation id, how can i map this event with CIM and add the necessary tag?

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Generally the TA should means to extract required eventtype (s) to map to Email data model. If it isn't and you are writting custom TA or updating existing TA, I would suggest not combine all events to get full email transaction, but have one or more events only for inbound email and one or more outbound. This way you can create eventtypes for inbound and outbound and then map them to Email datamodel.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...