Baseline checks
Host-configuration baseline and OS end-of-life compliance patrol: a rule library, manual or daily runs, results and trends per host. Data from the CIM Endpoint / Change data models.
Baseline checks express "what every host should look like" as rules, judge them against the endpoint data already in Splunk, and produce a score and failed items. Available in every edition.
Data source
Judgements run over the CIM Endpoint (Processes / Services / Ports / Registry / Filesystem) and Change data models with tstats; an osquery TA's sourcetypes work directly. Hosts are enumerated from Endpoint.Processes by default; without CIM data a run can be given an explicit hosts=.
OS end-of-life dates come from a bundled catalogue (copilot_eol_catalog), refreshable with eol_sync.py.
Three tabs
| Tab | Content |
|---|---|
| Rules | The library: id, platform (linux / windows), collection SPL fragment, judgement (equals / contains / threshold), severity, enabled; "Import defaults" loads a CIS starter pack; a rule can be dry-run to see what it collects |
| Runs | Each run's time, hosts, pass / fail / error, score; "Run now" runs manually; [baseline] schedule_enabled = 1 runs daily |
| Results | Host × rule judgements with evidence on failures; a score trend line |
Field map
"Field map" shows which data-model field each rule field resolves to on this instance; without CIM a built-in minimal table applies.
Notes
tstatscovers index-time fields and accelerated data models only; search-time extractions need| stats.- A demo box without CIM Endpoint data enumerates no hosts and "Run now" reports 0; pass
hosts=or onboard endpoint data first.
Asset inventory
Business context for assets and identities: Enterprise Security's asset / identity lookups or CSV import; investigations, triage and reports pick up owner and criticality automatically.
Data onboarding
Paste raw log lines → detect the format → generate props.conf / transforms.conf / rex / CIM mapping → dry-run coverage on real data → apply to local/ with rollback. Since 1.7.0.