CIM field change report

Learn about the CIM field changes between the latest version of the Splunk Add-on for Microsoft Cloud Services and version 4.4.0.

Summary of changes

• Sourcetypes with changes: 18
• Total deleted fields: 6
• Total modified fields: 12
• Total new fields: 204

Detailed changes

azure:monitor:aad

Field	Deleted	Modified	New	Is CIM
action	❌	❌	✅	✅
change_type	❌	❌	✅	✅
dataset_name	❌	❌	✅	❌
eventtype	❌	✅	❌	✅
object	✅	✅	❌	✅
object_attrs	❌	✅	✅	✅
object_attrs_from_resultReason	❌	❌	✅	❌
object_category	❌	❌	✅	✅
object_id	✅	✅	❌	✅
object_path	❌	❌	✅	✅
path_from_resourceId	❌	❌	✅	❌
result	❌	✅	❌	✅
result_id	❌	✅	❌	✅
src_user	❌	❌	✅	✅
src_user_name	❌	❌	✅	✅
src_user_type	❌	✅	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
user	❌	✅	✅	✅
user_name	❌	✅	✅	✅
user_type	❌	❌	✅	✅

azure:monitor:activity

Field	Deleted	Modified	New	Is CIM
action	❌	❌	✅	✅
blobservice	❌	❌	✅	❌
change_type	❌	❌	✅	✅
command	❌	❌	✅	✅
dataset_name	❌	❌	✅	❌
dest	❌	❌	✅	✅
dvc	❌	❌	✅	✅
eventhub_name	❌	❌	✅	❌
eventtype	❌	❌	✅	✅
image_id	❌	❌	✅	✅
instance_type	❌	❌	✅	✅
instance_type_value	❌	❌	✅	❌
namespace	❌	❌	✅	❌
object	❌	❌	✅	✅
object_attrs	❌	❌	✅	✅
object_category	❌	❌	✅	✅
object_from_sites	❌	❌	✅	❌
object_id	❌	❌	✅	✅
object_name	❌	❌	✅	❌
object_path	❌	❌	✅	✅
publisher	❌	❌	✅	❌
resource_group	❌	❌	✅	❌
resource_provider	❌	❌	✅	❌
resource_provider_from_resource_id	❌	❌	✅	❌
response_body	❌	❌	✅	❌
result	❌	❌	✅	✅
result_id	❌	❌	✅	✅
sku	❌	❌	✅	❌
src	❌	❌	✅	✅
status	❌	❌	✅	✅
storage_acc_name	❌	❌	✅	❌
storage_account	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
user	❌	❌	✅	✅
user_name	❌	❌	✅	✅
user_type	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅
vendor_region	❌	❌	✅	✅
version	❌	❌	✅	✅
vm_name	❌	❌	✅	❌
web_app_name	❌	❌	✅	❌
workspace_name	❌	❌	✅	❌

azure:monitor:resource

Field	Deleted	Modified	New	Is CIM
ACCOUNTS	❌	❌	✅	❌
DATABASEACCOUNTS	❌	❌	✅	❌
PROVIDERS	❌	❌	✅	❌
RESOURCEGROUPS	❌	❌	✅	❌
RHCStatus	❌	❌	✅	❌
SUBSCRIPTIONS	❌	❌	✅	❌
account	❌	❌	✅	❌
account_name	✅	❌	❌	❌
action	❌	❌	✅	✅
app	❌	❌	✅	✅
change_type	✅	✅	❌	✅
company	❌	❌	✅	❌
consumerName	❌	❌	✅	❌
dest	❌	❌	✅	✅
dest_name	❌	❌	✅	✅
destinationLocation	❌	❌	✅	❌
detailMessage	❌	❌	✅	❌
dvc	✅	✅	❌	✅
endTime	❌	❌	✅	❌
eventtype	❌	❌	✅	✅
object	❌	❌	✅	✅
object_attrs	❌	❌	✅	✅
object_category	❌	❌	✅	✅
object_id	❌	❌	✅	✅
object_path	❌	❌	✅	✅
parent_object	❌	❌	✅	✅
parent_object_category	❌	❌	✅	✅
parent_object_id	❌	❌	✅	✅
providerName	❌	❌	✅	❌
recipient	❌	❌	✅	✅
result	❌	❌	✅	✅
result_id	❌	❌	✅	✅
shareResourceId	❌	❌	✅	❌
shareSubscriptionResourceId	❌	❌	✅	❌
shareSubscriptions	❌	❌	✅	❌
shares	❌	❌	✅	❌
sourceLocation	❌	❌	✅	❌
startTime	❌	❌	✅	❌
status	❌	❌	✅	✅
syncDuration	❌	❌	✅	❌
synchronizationId	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
tenant_id	❌	❌	✅	❌
triggerType	❌	❌	✅	❌
user	❌	❌	✅	✅
vendor_account	❌	❌	✅	✅
vendor_product	✅	✅	❌	✅
vendor_region	❌	❌	✅	✅

mscs:azure:audit

Field	Deleted	Modified	New	Is CIM
object	❌	❌	✅	✅
object_id	❌	❌	✅	✅
object_path	❌	❌	✅	✅

mscs:azure:security:alert

Field	Deleted	Modified	New	Is CIM
resource_group	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌

mscs:azure:security:recommendation

Field	Deleted	Modified	New	Is CIM
resource_group	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌

mscs:metrics:events

Field	Deleted	Modified	New	Is CIM
time	❌	❌	✅	✅

mscs:resource:disk

Field	Deleted	Modified	New	Is CIM
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
family	❌	❌	✅	✅
hypervisor_id	❌	❌	✅	✅
mount	❌	❌	✅	✅
parent	❌	❌	✅	✅
read_blocks	❌	❌	✅	✅
read_ops	❌	❌	✅	✅
resource_group	❌	❌	✅	❌
serial	❌	❌	✅	✅
status	❌	❌	✅	✅
storage	❌	❌	✅	✅
subscription_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
vendor_product	❌	❌	✅	✅
version	❌	❌	✅	✅
write_blocks	❌	❌	✅	✅
write_ops	❌	❌	✅	✅

mscs:resource:image

Field	Deleted	Modified	New	Is CIM
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
family	❌	❌	✅	✅
hypervisor_id	❌	❌	✅	✅
resource_group	❌	❌	✅	❌
status	❌	❌	✅	✅
subscription_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
vendor_product	❌	❌	✅	✅
version	❌	❌	✅	✅

mscs:resource:networkInterfaceCard

Field	Deleted	Modified	New	Is CIM
resource_group	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌

mscs:resource:publicIPAddress

Field	Deleted	Modified	New	Is CIM
resource_group	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌

mscs:resource:resourceGroup

Field	Deleted	Modified	New	Is CIM
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
family	❌	❌	✅	✅
resource_group	❌	❌	✅	❌
status	❌	❌	✅	✅
subscription_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
vendor_product	❌	❌	✅	✅

mscs:resource:securityGroup

Field	Deleted	Modified	New	Is CIM
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
family	❌	❌	✅	✅
resource_group	❌	❌	✅	❌
serial	❌	❌	✅	✅
status	❌	❌	✅	✅
subscription_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
vendor_product	❌	❌	✅	✅

mscs:resource:snapshot

Field	Deleted	Modified	New	Is CIM
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
family	❌	❌	✅	✅
resource_group	❌	❌	✅	❌
size	❌	❌	✅	✅
snapshot	❌	❌	✅	✅
status	❌	❌	✅	✅
subscription_id	❌	❌	✅	❌
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
time	❌	❌	✅	✅
vendor_product	❌	❌	✅	✅

mscs:resource:subscriptions

Field	Deleted	Modified	New	Is CIM
description	❌	❌	✅	✅
dest	❌	❌	✅	✅
enabled	❌	❌	✅	✅
eventtype	❌	❌	✅	✅
family	❌	❌	✅	✅
serial	❌	❌	✅	✅
status	❌	❌	✅	✅
tag	❌	❌	✅	✅
tag::eventtype	❌	❌	✅	❌
vendor_product	❌	❌	✅	✅

mscs:resource:topology

Field	Deleted	Modified	New	Is CIM
resourceType	❌	❌	✅	❌
topo_resource_group	❌	❌	✅	❌
topo_subnet	❌	❌	✅	❌
topo_subscription_id	❌	❌	✅	❌
topo_vnet	❌	❌	✅	❌

mscs:resource:virtualMachine

Field	Deleted	Modified	New	Is CIM
ip	❌	❌	✅	✅
resource_group	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌

mscs:resource:virtualNetwork

Field	Deleted	Modified	New	Is CIM
resource_group	❌	❌	✅	❌
subscription_id	❌	❌	✅	❌