Learning Splunk - Applying the Common Information Model to Your Firewall Logs

The video tutorial explains how to apply the Common Information Model (CIM) to firewall logs using Splunk. It begins with finding and installing relevant apps in Splunk, specifically for Linux IP tables. The tutorial covers the process of configuring and restarting Splunk, followed by analyzing the ingested firewall logs. The logs are transformed from vendor-specific fields to CIM-compliant fields, making them more usable. The video concludes with a brief overview of the next steps in using the Splunk environment for further searching and reporting.

What new insight or understanding did you gain from this video?