Skip to content
This repository was archived by the owner on Nov 17, 2023. It is now read-only.

Commit 6e1ee5f

Browse files
author
rfaircloth-splunk
committed
release 4.15.0
1 parent 41b3cd7 commit 6e1ee5f

File tree

146 files changed

+39485
-2
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

146 files changed

+39485
-2
lines changed

‎README.md

-2
This file was deleted.

‎README.txt

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
ReadMe
2+
Splunk Common Information Model 4.15.0
3+
4+
Copyright (C) 2005-2018 Splunk Inc. All rights reserved.
5+
6+
* For the Release Notes, What's New, and Getting Started documentation for this
7+
release see:
8+
http://docs.splunk.com/Documentation/CIM/
9+
10+

‎README/alert_actions.conf.example

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
2+
[my_action]
3+
4+
...
5+
6+
param._cam = {\
7+
"category": ["Information Gathering"],\
8+
"task": ["create"],\
9+
"subject": ["network.capture"],\
10+
"technology": [{"vendor": "Splunk", "product": "Splunk App for Stream"}],\
11+
"supports_adhoc": true,\
12+
"drilldown_uri": "my_view?form.orig_sid=$sid$&form.orig_rid=$rid$"\
13+
}
14+
15+
16+
[my_action2]
17+
18+
...
19+
20+
param._cam = {\
21+
"category": ["Information Gathering"],\
22+
"task": ["scan"],\
23+
"subject": ["process.reputation-service"],\
24+
"technology": [{"vendor": "myvendor", "product": "myproduct", "version": "1.0"}],\
25+
"supports_adhoc": true,\
26+
"drilldown_uri": "../my_app/my_view?form.orig_sid=$sid$&form.orig_rid=$rid$",\
27+
"field_name_params": ["param.host_field"]\
28+
}

‎README/alert_actions.conf.spec

+98
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
2+
param._cam = <json>
3+
* Json specification for classifying response actions.
4+
* See Appendix A.
5+
* Optional.
6+
* Defaults to None.
7+
8+
param._cam_workers = <json>
9+
* Json specification for defining remote workers.
10+
* See Appendix B.
11+
* Optional.
12+
* Defaults to None.
13+
14+
15+
###### Appendix A: Common Action Model Specification #######
16+
## category: The category or categories the modular action belongs to.
17+
## Required.
18+
## For instance, "Information Gathering".
19+
## See cam_categories.csv for recommended values.
20+
## task: The function or functions performed by the modular action.
21+
## Required.
22+
## For instance, "create".
23+
## See cam_tasks.csv for recommended values.
24+
## subject: The object or objects that the modular action's task(s)
25+
## can be performed on (i.e. "endpoint.file").
26+
## Required.
27+
## See cam_subjects.csv for recommended values.
28+
## technology: The technology or technologies that the modular action supports.
29+
## Required.
30+
## vendor: The vendor of the technology.
31+
## Required.
32+
## For instance, "Splunk".
33+
## product: The product of the technology.
34+
## Required.
35+
## For instance, "Enterprise".
36+
## version: The version or versions of the technology.
37+
## Optional.
38+
## For instance, "6.4".
39+
## drilldown_uri: Specifies a custom target for viewing the events
40+
## outputted as a result of the action.
41+
## Custom target can specify app and/or view depending on syntax.
42+
## Optional.
43+
## For instance, "my_view?form.orig_sid=$sid$&form.orig_rid=$rid$"
44+
## For instance, "../my_app/my_view?form.orig_sid=$sid$&form.orig_rid=$rid$"
45+
## field_name_params: The param or params which represent the name of a result field.
46+
## Optional.
47+
## For instance, ["param.search_field"] indicates that the value of "param.search_field"
48+
## should be present as a field in the result or results being operated on.
49+
## required_params: Parameter(s) required for successful action execution.
50+
## Indicated by "*" in the custom alert action user interface.
51+
## For instance, ["param.search_field"] indicates that "param.search_field"
52+
## should be specified when submitting the action on the custom alert action
53+
## user interface.
54+
## Optional.
55+
## supports_adhoc: Specifies if the modular action supports adhoc invocations.
56+
## Optional.
57+
## Defaults to False.
58+
## supports_cloud: Specifies if the modular actions supports the "cloud" model.
59+
## For instance, does the action function properly when the search head does not have access
60+
## to the local network.
61+
## Optional.
62+
## Defaults to True.
63+
## supports_workers: Specifies if the modular actions supports remote workers.
64+
## supports_workers==True implies supports_cloud==True
65+
## Optional.
66+
## Defaults to False.
67+
#{
68+
# "category": ["<category>", ..., "<category">],
69+
# "task": ["<task>", ..., "<task>"],
70+
# "subject": ["<subject>", ..., "<subject>"],
71+
# "technology": [{ "vendor": "<vendor>",
72+
# "product": "<product>",
73+
# "version": ["<version>", ..., "<version>"]
74+
# },
75+
# ...,
76+
# { "vendor": "<vendor>",
77+
# "product": "<product>",
78+
# "version": ["<version>", ..., "<version>"]
79+
# }
80+
# ],
81+
# "drilldown_uri": "<uri>",
82+
# "field_name_params": ["<param.param1>", ..., "<param.paramN>"],
83+
# "required_params": ["<param.param1>", ..., "<param.paramN>"]
84+
# "supports_adhoc": true | false,
85+
# "supports_cloud": true | false,
86+
# "supports_workers": true | false
87+
#}
88+
89+
90+
###### Appendix B: Common Action Model Remote Workers Specification #######
91+
## List of Splunk "serverName" values as advertised by /server/info
92+
##
93+
## Special "serverName" values:
94+
## * "local" - action script will continue doing work locally in addition to
95+
## queueing work for additional workers (if specified).
96+
##
97+
##
98+
## [ "local"?, "worker1", "worker2", ..., "workern" ]

‎README/commands.conf.spec

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
2+
[<STANZA_NAME>]
3+
python.version = {default|python|python2|python3}
4+
* Optional setting. Requires 8.0+
5+
* For Python scripts only, selects which Python version to use.
6+
* Set to either "default" or "python" to use the system-wide default Python
7+
version.
8+
* Optional.
9+
* Default: Not set; uses the system-wide Python version.

‎README/datamodels.conf.spec

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
2+
acceleration.allow_old_summaries = <bool>
3+
* Optional setting. Requires 7.1+
4+
* Sets the default value of 'allow_old_summaries' for this data model.
5+
* Only applies to accelerated datamodels.
6+
* When you use commands like 'datamodel', 'from', or 'tstats' to run a search
7+
on this data model, allow_old_summaries=false causes the Splunk software to
8+
verify that the data model search in each bucket's summary metadata matches
9+
the scheduled search that currently populates the data model summary.
10+
Summaries that fail this check are considered "out of date" and are not used
11+
to deliver results for your events search.
12+
* This setting helps with situations where the definition of an accelerated
13+
data model has changed, but the Splunk software has not yet updated its
14+
summaries to reflect this change. When allow_old_summaries=false for a data
15+
model, an event search of that data model only returns results from bucket
16+
summaries that match the current definition of the data model.
17+
* If you set allow_old_summaries=true, your search delivers results from
18+
bucket summaries that are out of date with the current data model definition.
19+
* Default: false

‎README/inputs.conf.example

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[relaymodaction://master]
2+
uri = https://master:8089
3+
description = splunk cloud search head
4+
username = username
5+
verify = True
6+
client_cert = client_cert.pem

‎README/inputs.conf.spec

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
2+
python.version = {default|python|python2|python3}
3+
* Optional setting. Requires 8.0+
4+
* For Python scripts only, selects which Python version to use.
5+
* Set to either "default" or "python" to use the system-wide default Python
6+
version.
7+
* Optional.
8+
* Default: Not set; uses the system-wide Python version.
9+
10+
[relaymodaction://<name>]
11+
uri = <string>
12+
* Remote splunk instance management URI.
13+
* Format should be protocol://host:port
14+
15+
description = <string>
16+
* Description for the remote Splunk instance.
17+
18+
username = <string>
19+
* Label pertaining to the API key stored in secure storage, must be unique.
20+
* Realm is "cam_queue".
21+
22+
verify = <string>
23+
* Specifies if SSL verification is needed between worker and remote search head.
24+
* Defaults to True
25+
26+
client_cert = <string>
27+
* Filename of client certificate.
28+
* Specify when SSL verification is needed, leave empty otherwise.
29+
* Certificate should be put in $splunk_home/etc/apps/Splunk_SA_CIM/auth

‎README/restmap.conf.spec

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
2+
[script:<uniqueName>]
3+
python.version={default|python|python2|python3}
4+
* Optional setting. Requires 8.0+
5+
* For Python scripts only, selects which Python version to use.
6+
* Set to either "default" or "python" to use the system-wide default Python
7+
version.
8+
* Optional.
9+
* Default: Not set; uses the system-wide Python version.

0 commit comments

Comments
 (0)