In simpler terms, this app trades search efficiency in exchange for data/vendor agnostic queries via the Common Information Model. This app should be deployed on a search head that meets or exceeds the hardware specification for a dedicated search head due to the use of tags and event types (and to a lesser degree a high number of accelerated searches). (Splunk Common Information Model (CIM)) Deployment: Note that this is not a comprehensive list and that any CIM-compliant TAs will drive the reports and visuzlizations in this app Leverage CIM-compliant Splunk Technology Add-ons (TAs), freely available on, to apply the CIM tags and event types to their raw data Example CIM-Compliant TAs that were used for development and testing Ingest data relevant to the various Critical control families into a Splunk Enterprise (or Splunk Cloud) instanceī. In order for this app to visualize your data in the context of the controls framework, users must conform to the following basic prerequisites:Ī. This app was designed for any security team or Splunk administrator seeking pre-configured, easily extended visibility into an organization’s CIS Top 20 Critical Controls compliance - regardless of what type of data, equipment, or architecture that organization may use. This app provides a data-agnostic framework that leverages Splunk tags, event types, and fields from Splunk's common information model (CIM) to easily visualize and report on these controls regardless of the size or sophistication of an organization’s security team.

The CIS Controls app for Splunk was designed to provide a consolidated, easily-extensible framework for baseline security “best-practices” based on the Top 20 Critical Security Controls v6.1 published by the Center for Internet Security. Developed by Anthony Perez (anthony at ) Overview:

Sans 20 critical security controls pdf