V1.0.0 Release

Version 1.0.0 Release Notes

A Splunk Technology Add-On (TA) to provide CIM compliance on Lacework alert and audit data. This add-on is designed to work in conjuction with the Splunk integration available via Lacework UI.

v0.0.1

Release Notes

Version 0.0.1 release of the Lacework Splunk Add-on.

Features

• CIM compliance mapping for Lacework events ingested by Splunk.
• Data models mapped to include: Vulnerability, Malware, Network Traffic, Authentication, Endpoint (process specific), Endpoint (file system specific)

Notes

• This add-on works in conjunction with the existing Lacework UI integration with Splunk. It DOES NOT replace it.
• In the UI Integration, the ‘Source’ field must be set to ‘lacework’ for the TA to properly parse and map fields to CIM