Investigate and remediate CIM non-compliance

Investigate and remediate CIM non-compliance issues to ensure configurations meet required standards.

Overview

When CIM non-compliance alerts trigger, investigate and remediate CIM non-compliance issues to ensure configurations meet required standards.

Review a triggered alert group

Perform the following steps to access the remediation workflow:

  1. In the Ingest Monitoring app left navigation pane, select Alerts.

  2. Select the Triggered alerts tab.

  3. Find and select the triggered CIM non-compliance alert in the list. The details panel opens.

  4. Select Investigate.

    The Investigation page opens, showing the group's stats, such as when each alert in the group was triggered, sample events, and the non-compliant values highlighted for each monitored field.

  5. When you are ready, select Start remediation.

    The Remediation wizard opens, and it starts the AI analysis step.

Analyze alerts

The system automatically performs the following actions:

  1. Retrieves the triggered alert results, including failed fields, failure reasons, and coverage percentages.

  2. Collects sample events from your data to identify the actual field values.

  3. Identifies the relevant add-on stanza configurations in props.conf and transforms.conf.

  4. Sends the information to the AI analysis service.

A progress indicator appears, displaying the AI's reasoning and validation progress for each stage of the process. When AI analysis completes, the system provides a summary of non-compliant fields and the reason for the failure, such as missing or incorrect values. It then describes which fields are fixable and which are not, along with a confidence level for each fixable field, and proposes fixes based on your add-on configuration.

Review the AI analysis and select Continue to approve the fixes.

Best practice remediations

Review the AI-generated configuration fixes in this step.

Proposed changes are grouped by target file, such as props.conf or transforms.conf. Use the tab bar to switch between files. A side-by-side difference editor shows your current configuration on the left and the proposed fix on the right, with changes highlighted. Expand the AI reasoning panel to see a detailed explanation for each change.

A field extraction preview table appears, based on the new props.conf and transforms.conf, displaying which monitored fields are now compliant, and which are still not compliant.

Review the proposed changes carefully before you proceed.

When you are satisfied with the changes, select Continue.

Download artifacts

You can download the generated add-on configuration files.

The left panel lists all generated configuration files with their file paths.

  1. Select any file to preview its contents in the code editor on the right.

  2. Select Download TA package to download the complete add-on overlay as a .tar.gz package ready for deployment. You can also download individual files by selecting the download icon next to each file in the list.

  3. Select Continue after downloading the package.

Install and deploy the add-on overlay package

Next, install and deploy the add-on overlay package to your Splunk Platform environment.

Deploy the overlay to the same search head where you ran the detection and remediation. The generated overlay add-on only works on the search head where the detection and remediation ran. Deploy the overlay add-on back to that same search head. An overlay generated on one search head will not fix compliance issues on a different search head.

Avoid complications with future fixes by installing the add-on overlay package before you perform a run on the same alert rules.

The uploaded app appears in the table on the Uploaded Apps page. The app name and version are displayed when the package passes all cloud vetting checks.

For more details, see the Deploy and manage private apps topic in the Splunk developer documentation.

Select Done to return to the Triggered Alerts list.