CIM field change report

Learn about the CIM field changes between the latest version of the Splunk Add-on for Microsoft Cloud Services and version 4.2.0.

Summary of changes

• Sourcetypes with changes: 18
• Total deleted fields: 0
• Total modified fields: 0
• Total new fields: 266

Detailed changes

azure:monitor:aad

Field	Deleted	Modified	New	Is CIM
Email	❌	❌	✅	❌
InvitationId	❌	❌	✅	❌
ObjectId	❌	❌	✅	❌
UPN	❌	❌	✅	❌
UserObjectId	❌	❌	✅	❌
action	❌	❌	✅	✅
additional_details	❌	❌	✅	❌
additional_details_name	❌	❌	✅	❌
additional_details_value	❌	❌	✅	❌
app	❌	❌	✅	✅
authentication_method	❌	❌	✅	✅
authentication_service	❌	❌	✅	✅
change_type	❌	❌	✅	✅
command	❌	❌	✅	✅
dataset_name	❌	❌	✅	❌
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
dest_type	❌	❌	✅	✅
duration	❌	❌	✅	✅
dvc	❌	❌	✅	✅
enabled	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
id	❌	❌	✅	✅
object	❌	❌	✅	✅
object_attrs	❌	❌	✅	✅
object_attrs_from_resultReason	❌	❌	✅	❌
object_category	❌	❌	✅	✅
object_id	❌	❌	✅	✅
object_path	❌	❌	✅	✅
path_from_resourceId	❌	❌	✅	❌
properties.additionalDetails{}.key	❌	❌	✅	❌
properties.additionalDetails{}.value	❌	❌	✅	❌
properties.targetResources{}.modifiedProperties{}.newValue	❌	❌	✅	❌
reason	❌	❌	✅	✅
response_time	❌	❌	✅	✅
result	❌	❌	✅	✅
result_id	❌	❌	✅	✅
severity	❌	❌	✅	✅
signature	❌	❌	✅	✅
signature_id	❌	❌	✅	✅
signinDateTime	❌	❌	✅	❌
src	❌	❌	✅	✅
src_ip	❌	❌	✅	✅
src_user	❌	❌	✅	✅
src_user_name	❌	❌	✅	✅
src_user_type	❌	❌	✅	✅
status	❌	❌	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
type	❌	❌	✅	✅
user	❌	❌	✅	✅
user_agent	❌	❌	✅	✅
user_id	❌	❌	✅	✅
user_name	❌	❌	✅	✅
user_role	❌	❌	✅	✅
user_type	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
vendor_region	❌	❌	✅	✅

azure:monitor:activity

Field	Deleted	Modified	New	Is CIM
ResourceGroup	❌	❌	✅	❌
Subscription	❌	❌	✅	❌
action	❌	❌	✅	✅
blobservice	❌	❌	✅	❌
change_type	❌	❌	✅	✅
command	❌	❌	✅	✅
dataset_name	❌	❌	✅	❌
dest	❌	❌	✅	✅
dvc	❌	❌	✅	✅
eventhub_name	❌	❌	✅	❌
eventtype	❌	❌	✅	✅
image_id	❌	❌	✅	✅
instance_type	❌	❌	✅	✅
instance_type_value	❌	❌	✅	❌
namespace	❌	❌	✅	❌
object	❌	❌	✅	✅
object_attrs	❌	❌	✅	✅
object_category	❌	❌	✅	✅
object_from_sites	❌	❌	✅	❌
object_id	❌	❌	✅	✅
object_name	❌	❌	✅	❌
object_path	❌	❌	✅	✅
properties.entity	❌	❌	✅	❌
properties.hierarchy	❌	❌	✅	❌
properties.message	❌	❌	✅	❌
publisher	❌	❌	✅	❌
resource_group	❌	❌	✅	❌
resource_provider	❌	❌	✅	❌
resource_provider_from_resource_id	❌	❌	✅	❌
response_body	❌	❌	✅	❌
result	❌	❌	✅	✅
result_id	❌	❌	✅	✅
sku	❌	❌	✅	❌
src	❌	❌	✅	✅
status	❌	❌	✅	✅
storage_acc_name	❌	❌	✅	❌
storage_account	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
tenantId	❌	❌	✅	❌
user	❌	❌	✅	✅
user_name	❌	❌	✅	✅
user_type	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
vendor_region	❌	❌	✅	✅
version	❌	❌	✅	✅
vm_name	❌	❌	✅	❌
web_app_name	❌	❌	✅	❌
workspace_name	❌	❌	✅	❌

azure:monitor:resource

Field	Deleted	Modified	New	Is CIM
ACCOUNTS	❌	❌	✅	❌
DATABASEACCOUNTS	❌	❌	✅	❌
PROVIDERS	❌	❌	✅	❌
RESOURCEGROUPS	❌	❌	✅	❌
RHCStatus	❌	❌	✅	❌
SUBSCRIPTIONS	❌	❌	✅	❌
account	❌	❌	✅	❌
action	❌	❌	✅	✅
app	❌	❌	✅	✅
change_type	❌	❌	✅	✅
command	❌	❌	✅	✅
company	❌	❌	✅	❌
consumerName	❌	❌	✅	❌
dest	❌	❌	✅	✅
dest_name	❌	❌	✅	✅
destinationLocation	❌	❌	✅	❌
detailMessage	❌	❌	✅	❌
duration	❌	❌	✅	✅
dvc	❌	❌	✅	✅
endTime	❌	❌	✅	❌
eventtype	❌	❌	✅	✅
object	❌	❌	✅	✅
object_attrs	❌	❌	✅	✅
object_category	❌	❌	✅	✅
object_id	❌	❌	✅	✅
object_name_before_slash	❌	❌	✅	❌
object_name_controlplane	❌	❌	✅	❌
object_name_dataplane	❌	❌	✅	❌
object_path	❌	❌	✅	✅
parent_object	❌	❌	✅	✅
parent_object_category	❌	❌	✅	✅
parent_object_id	❌	❌	✅	✅
providerName	❌	❌	✅	❌
recipient	❌	❌	✅	✅
resourcedetails_key	❌	❌	✅	❌
resourcedetails_value	❌	❌	✅	❌
result	❌	❌	✅	✅
result_id	❌	❌	✅	✅
shareResourceId	❌	❌	✅	❌
shareSubscriptionResourceId	❌	❌	✅	❌
shareSubscriptions	❌	❌	✅	❌
shares	❌	❌	✅	❌
sourceLocation	❌	❌	✅	❌
src	❌	❌	✅	✅
startTime	❌	❌	✅	❌
status	❌	❌	✅	✅
syncDuration	❌	❌	✅	❌
synchronizationId	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
tenant_id	❌	❌	✅	❌
triggerType	❌	❌	✅	❌
user	❌	❌	✅	✅
user_agent	❌	❌	✅	✅
user_name	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
vendor_region	❌	❌	✅	✅

mscs:azure:audit

Field	Deleted	Modified	New	Is CIM
object	❌	❌	✅	✅
object_id	❌	❌	✅	✅
object_path	❌	❌	✅	✅

mscs:azure:security:alert

Field	Deleted	Modified	New	Is CIM
resource_group	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌

mscs:azure:security:recommendation

Field	Deleted	Modified	New	Is CIM
resource_group	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌

mscs:metrics:events

Field	Deleted	Modified	New	Is CIM
time	❌	❌	✅	✅

mscs:resource:disk

Field	Deleted	Modified	New	Is CIM
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
family	❌	❌	✅	✅
hypervisor_id	❌	❌	✅	✅
mount	❌	❌	✅	✅
parent	❌	❌	✅	✅
read_blocks	❌	❌	✅	✅
read_ops	❌	❌	✅	✅
resource_group	❌	❌	✅	❌
serial	❌	❌	✅	✅
status	❌	❌	✅	✅
storage	❌	❌	✅	✅
subscription_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
vendor_product	❌	❌	✅	✅
version	❌	❌	✅	✅
write_blocks	❌	❌	✅	✅
write_ops	❌	❌	✅	✅

mscs:resource:image

Field	Deleted	Modified	New	Is CIM
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
family	❌	❌	✅	✅
hypervisor_id	❌	❌	✅	✅
resource_group	❌	❌	✅	❌
status	❌	❌	✅	✅
subscription_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
vendor_product	❌	❌	✅	✅
version	❌	❌	✅	✅

mscs:resource:networkInterfaceCard

Field	Deleted	Modified	New	Is CIM
resource_group	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌

mscs:resource:publicIPAddress

Field	Deleted	Modified	New	Is CIM
resource_group	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌

mscs:resource:resourceGroup

Field	Deleted	Modified	New	Is CIM
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
family	❌	❌	✅	✅
resource_group	❌	❌	✅	❌
status	❌	❌	✅	✅
subscription_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
vendor_product	❌	❌	✅	✅

mscs:resource:securityGroup

Field	Deleted	Modified	New	Is CIM
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
family	❌	❌	✅	✅
resource_group	❌	❌	✅	❌
serial	❌	❌	✅	✅
status	❌	❌	✅	✅
subscription_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
vendor_product	❌	❌	✅	✅

mscs:resource:snapshot

Field	Deleted	Modified	New	Is CIM
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
family	❌	❌	✅	✅
resource_group	❌	❌	✅	❌
size	❌	❌	✅	✅
snapshot	❌	❌	✅	✅
status	❌	❌	✅	✅
subscription_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
time	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅

mscs:resource:subscriptions

Field	Deleted	Modified	New	Is CIM
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
enabled	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
family	❌	❌	✅	✅
serial	❌	❌	✅	✅
status	❌	❌	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
vendor_product	❌	❌	✅	✅

mscs:resource:topology

Field	Deleted	Modified	New	Is CIM
resourceType	❌	❌	✅	❌
topo_resource_group	❌	❌	✅	❌
topo_subnet	❌	❌	✅	❌
topo_subscription_id	❌	❌	✅	❌
topo_vnet	❌	❌	✅	❌

mscs:resource:virtualMachine

Field	Deleted	Modified	New	Is CIM
ip	❌	❌	✅	✅
resource_group	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌

mscs:resource:virtualNetwork

Field	Deleted	Modified	New	Is CIM
resource_group	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌