thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Common Information Model (CIM)

Splunk's shared semantic model that normalizes field names across data sources into standard data models.

Definition

The CIM add-on defines data models such as Authentication, Network_Traffic, Endpoint, Web and Malware with standard fields like src, dest, user and action. Technology add-ons map vendor data to CIM so apps like Enterprise Security work across sources. CIM compliance is required for ES correlation searches.

Example

Mapping both Windows and Okta logon events to the Authentication data model.

Exam tip

CIM = Splunk normalization; it enables vendor-agnostic searches and ES content.

Related terms