tenzir-cim

name

tenzir-cim

description

Answer questions and produce mappings for the Splunk Common Information Model (CIM), including CIM Add-on aliases such as SA-CIM, CommonInformationModel, and SA-CommonInformationModel. Use when the user mentions CIM data models/datamodels/DMs, datasets/data model objects, fields, field aliases, calculated/eval fields, tags, constraints, lookups/lookup tables, macros, normalization, mapping logs or events to CIM, CIM compliance, pytest-splunk-addon, technical add-ons/TAs, Splunk Enterprise Security/ES, data model acceleration, pivots, tstats, or datamodel searches.

Splunk Common Information Model

Version: 8.5.0

CIM is organized around data models. Each data model contains datasets, historically called data model objects. Datasets inherit fields and constraints from parent datasets. Event datasets ultimately inherit from BaseEvent; search datasets inherit from BaseSearch. All Splunk data model datasets can use the base fields _time, host, source, and sourcetype.

• Tags and constraints decide which events belong in a dataset.
• Fields describe the effective normalized shape that searches, dashboards, pivots, and downstream apps expect. Each field entry states whether it is base, declared, calculated, or inherited.
• Calculated field entries include a calculation block because they create or normalize fields at search time.
• Lookup files document expected values, translations, and enrichments, such as actions, protocols, HTTP statuses, DNS reply codes, endpoint statuses, and severities.

Data files

• Use data/catalog.yaml to choose a data model and find the generated files.
• Use data/models/<model>.yaml to inspect datasets, tags, constraints, and the effective fields map for one CIM data model.
• Use data/fields.yaml to find field-specific files.
• Use data/fields/<field>.yaml to inspect lookup links and where a field is declared or calculated across models and datasets.
• Use data/lookups.yaml and data/lookups/<lookup>.yaml for lookup-backed values, translations, and enrichments.
• Use docs/index.md and docs/pages/*.md for Splunk CIM 8.5 workflow guidance, examples, and explanatory prose.
• Use source.md for provenance and generation counts.

Treat docs/ as additional context only. Do not use docs pages as the authority for fields, tags, constraints, datasets, or lookup values when a generated data/ file exists.

Mapping rules

• Start from the event semantics, choose the closest CIM data model in data/catalog.yaml, then choose the dataset whose tags and constraints match the event.
• Apply all required tags and parent dataset tags implied by the dataset parent chain.
• Populate useful app-documented fields first, especially fields marked recommended or required.
• Treat fields with source: calculated or a calculation block as app-provided normalizations; when mapping a source, still populate the underlying source fields needed by those calculations when possible.
• Prefer specific fields such as src_ip, dest_ip, user, signature, or vendor_product over broad fields when the data source provides them.
• Use lookup files to normalize, translate, or enrich values when a lookup documents semantics for a field.
• Preserve source-specific details outside CIM fields when the app-derived reference has no normalized CIM field.

Question routing

• Which CIM model should this log map to? data/catalog.yaml, then the closest model file.
• What tags or constraints identify a dataset? data/models/<model>.yaml.
• What fields does a dataset include? fields in data/models/<model>.yaml.
• What does field X mean? data/fields.yaml, then data/fields/<field>.yaml.
• What values are expected for a field? Field expected_values, then data/lookups.yaml.
• What does Splunk say about CIM workflows? docs/index.md.
• What source produced this skill? source.md.