Non-CIM complaint mapping for cloud storage data

Use the following table to map the Splunk CIM field name to the non-CIM field name for cloud storage data. You can use the impala field names to validate the mapping values. The SPL examples show how to adjust field names and values to get cloud storage data into Splunk UBA correctly:

Splunk CIM field name Non-CIM field name example Impala table field (fileaccess_s) Example values ((Field_name, Filed_value) SPL example
file_sizeFILE_SIZE_BYTEresourcesize(FILE_SIZE_BYTE: 10280)rename FILE_SIZE_BYTE as file_size
objectSOURCE_FILE_NAMEresourcename(SOURCE_FILE_NAME,'this_picture.png')rename SOURCE_FILE_NAME as object
object_typeITEM_TYPEresourcetype

ITEM_TYPE, 'File')

(ITEM_TYPE, 'Folder')

(ITEM_TYPE, 'Document')

(ITEM_TYPE, 'Image')

rename ITEM_TYPE as object_type
file_hashITEM_UNIQUE_IDresourceid(ITEM_UNIQUE_ID, '17283982137')rename ITEM_UNIQUE_ID as file_hash
object_pathFILE_PATHsource(FILE_PATH, '/bpatinho/photos')rename FilePath as object_path
parent_categoryPARENT_RS_TYPEparentpathtype

(PARENT_RS_TYPE, 'Folder')

(PARENT_RS_TYPE, 'Link')

rename PARENT_RS_TYPE as parent_category
parent_hashPARENT_HASH_IDparentpathid(PARENT_HASH_ID, '9864239674')rename PARENT_HASH_ID as parent_hash
src_userSRC_USERsource

(SRC_USER, 'user1')

(SRC_USER,'user2')

rename SRC_USER as src_user
change_type OPERATION evcls

(Operation,' FileDownload')

(OPERATION,'FILEPREVIEW')

(OPERATION,'FILEDELETE')

(OPERATION,'FILECREATE')

(OPERATION,'FILEEDIT') 

| eval change_type=case(match(lower(change_type),
"FILEDELETE","delete",
match(lower(change_type)," FileDownload"),
"download",
match(lower(change_type), "FILECOPIED"),"create",
match(lower(change_type)," FILEPREVIEW"),"preview",
match(lower(change_type), "FILEEDIT"),"edit")
appAPP_NAMEservicename

(APP_NAME,'Box')

(APP_NAME,' Office365')

(APP_NAME,' Google Drive')

rename APP_NAME as app
dest_userDEST_USERdestinationusername(DEST_USER, 'Cronaldo')rename DEST_USER as dest_user