Field mapping for UEBA Content App for Cloud

mapping SIM fields to OCSF attrributes

A UEBA Dataset is the Splunk UEBA implementation of an event schema for detections that is compatible with OCSF (Open Cybersecurity Schema Framework). Each dataset leverages OCSF objects, attributes, and semantic definitions as Splunk-extracted fields so security telemetry can be normalized and processed by UEBA.

The UEBA Content App for Cloud currently includes the Network Activity UEBA Dataset type (link below). The app derives this dataset from the CIM Network_Traffic data model, maps CIM fields into OCSF-aligned UEBA Dataset fields, normalizes field values, aggregates network activity, and forwards the resulting events to UEBA Cloud for the Unusual Volume of Data detections.

Note: Splunk UEBA Cloud validates events during ingestion. Some events do not meet the detection dataset requirements, likely due to missing or unmapped CIM fields in the Network_Traffic data model. These events are dropped and do not contribute to downstream anomaly detections. If the scheduled search is running, but detections are not producing findings, refer to Troubleshooting the UEBA Content App for Cloud .

Network Activity Dataset

The following table shows how fields from the CIM Network_Traffic data model correspond to UEBA Dataset fields. For the full OCSF attribute definitions, see the Network Activity UEBA class.

Note:

Every event must include at least one of the Recommended fields.

The mapping macros flatten the OCSF nested attribute hierarchy into Splunk field names, using __ (double underscore) as the nesting separator.

CIM field OCSF attribute Required
src / src_nt_host src_endpoint.name Recommended
src_ip src_endpoint.ip Recommended
src_mac src_endpoint.mac Recommended
src_zone src_endpoint.zone Required
src_bunit src_endpoint.owner.org.ou_name Required
dest / dest_nt_host dst_endpoint.name Recommended
dest_ip dst_endpoint.ip Recommended
dest_mac dst_endpoint.mac Recommended
dest_zone dst_endpoint.zone Required
dest_bunit dst_endpoint.owner.org.ou_name Required
user actor.user.name Recommended
user_email actor.user.email_addr Recommended
user_bunit actor.user.org.ou_name Required
bytes traffic.bytes Required
bytes_in traffic.bytes_in Required
bytes_out traffic.bytes_out Required
action disposition Required
direction connection_info.direction Required