Viewing CLM Data
The data collected from different data sources is displayed in an embedded Kibana. With Kibana, you can easily deep dive into the logged events, using a free search and various filters, or create your own dashboard. To read more about how to use Kibana, click here. To view information collected by the Cynet CLM, navigate to Forensic > Analytics.Data MappingCynet CLM maps incoming data to fields defined by Elastic Common Schema. All fields are mapped according to this standard, therefore, they do not appear in their original format. You can not add custom fields. All fields are added by Cynet.Basic FieldsFieldDescriptionExample@timestampDate and time that the event occurredNAecs.versionManual version configured inside logstash.conf1.0.0event.kindHigh-level information on the type of event (event sub-category)alert, enrichmentevent.categoryNAauthentication, configurationtagstags describing event"firewall" messagelog message NAevent.severityThe numeric severity of the event according to your event source. 7event.providerType of data providerFirewall event.action*The action captured by the event Blockeduser.name*Short name or login of the usergroothondevent.type*Event sub-category, used together with event.categoryaccess, admin, allowed*Optional fieldsAdditional Fields for FirewallFieldDescriptionExampledestination.ipIP address of the destination (IPv4 or IPv6)192.168. 1.1destination.portPort of the destination5104observer.productProduct name of the observerVuurMuurobserver.vendorVendor name of the observerSophossource.ipIP address of the source (IPv4 or IPv6)192.168. 1.1source.portPort of the source5106destination.domain*The domain name of the destination system foo.example.com event.code*Identification code for this event, if one exists.NA*Optional fields