chore: update psa-cim-models branch references from v1/v2 to cim-5.3.3/cim-6.4

.github/workflows/build-test-release.yml

@@ -223,13 +223,13 @@ jobs:
       matrix:
         splunk: ${{ fromJson(needs.meta.outputs.matrix_supportedSplunk) }}
         cim-models:
-          - ref: "v1"
-            label: "1.x"
-          - ref: "v2"
-            label: "2.x"
+          - ref: "cim-5.3.3"
+            label: "5.x"
+          - ref: "cim-6.4"
+            label: "6.x"
           # Add future releases here, e.g.:
-          # - ref: "v3"
-          #   label: "3.x"
+          # - ref: "cim-7.x"
+          #   label: "7.x"
     name: "CIM models ${{ matrix.cim-models.label }} / Splunk ${{ matrix.splunk.version }}"
     steps:
       - uses: actions/checkout@v4
@@ -277,7 +277,7 @@ jobs:
           # runtime error rather than a wrong-field assertion.
           #
           # splunk_cim_model (real Change/Network_Traffic models) is left to
-          # test-splunk-matrix, which always uses the default v2 dev
+          # test-splunk-matrix, which always uses the default cim-6.4 dev
           # dependency and asserts version-specific field outcomes.
           poetry run pytest -v \
             --splunk-version=${{ matrix.splunk.version }} \

docs/cim_tests.md

@@ -23,7 +23,7 @@ pip install splunk-cim-models
 Or, during development, install the latest from the repository:
 
 ```console
-pip install git+https://github.com/splunk/psa-cim-models.git@v2
+pip install git+https://github.com/splunk/psa-cim-models.git@cim-6.4
 ```
 
 The package exposes:
@@ -109,11 +109,11 @@ To generate test cases only for CIM compatibility, append the following marker t
 
  **Workflow:**
 
- - Plugin collects the list of not_allowed_in_search fields from mapped datasets and [CommonFields.json](https://github.com/splunk/psa-cim-models/blob/v2/splunk_cim_models/CommonFields.json).
+ - Plugin collects the list of not_allowed_in_search fields from mapped datasets and [CommonFields.json](https://github.com/splunk/psa-cim-models/blob/cim-6.4/splunk_cim_models/CommonFields.json).
  - Using search query the test case verifies if not_allowed_in_search fields are populated in search or not.
 
 > **_NOTE:_** 
- [CommonFields.json](https://github.com/splunk/psa-cim-models/blob/v2/splunk_cim_models/CommonFields.json) contains fields which are automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security.
+ [CommonFields.json](https://github.com/splunk/psa-cim-models/blob/cim-6.4/splunk_cim_models/CommonFields.json) contains fields which are automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security.
 
 
 **4. Testcase for all not_allowed_in_props fields**

docs/contributing.md

@@ -18,7 +18,7 @@ To install currently checked out version of pytest-splunk-addon use:
 $ poetry install
 ```
 
-This installs `splunk-cim-models` automatically as a dev dependency (from the `v2` branch of
+This installs `splunk-cim-models` automatically as a dev dependency (from the `cim-6.4` branch of
 [psa-cim-models](https://github.com/splunk/psa-cim-models)). In CI or when installing from
 PyPI, install `splunk-cim-models` separately before running CIM tests:
 

docs/how_to_use.md

@@ -460,9 +460,9 @@ def splunk_setup(splunk):
 
  How can this be achieved :
 
-  - Make json representation of the data models, which satisfies the [DatamodelSchema](https://github.com/splunk/psa-cim-models/blob/v2/splunk_cim_models/DatamodelSchema.json) provided by the `splunk-cim-models` package.
+  - Make json representation of the data models, which satisfies the [DatamodelSchema](https://github.com/splunk/psa-cim-models/blob/cim-6.4/splunk_cim_models/DatamodelSchema.json) provided by the `splunk-cim-models` package.
   - Provide the path to the directory having all the data models by adding `--splunk_dm_path path_to_dir` to the pytest command.
-  - The test cases will now be generated for the data models provided to the plugin and not for the [default data models](https://github.com/splunk/psa-cim-models/tree/v2/splunk_cim_models/data_models) bundled in `splunk-cim-models`.
+  - The test cases will now be generated for the data models provided to the plugin and not for the [default data models](https://github.com/splunk/psa-cim-models/tree/cim-6.4/splunk_cim_models/data_models) bundled in `splunk-cim-models`.
 
 > **_NOTE:_** CIM data model definitions are provided by the [`splunk-cim-models`](https://github.com/splunk/psa-cim-models) package. Install it separately before running CIM tests:
 >

pyproject.toml

@@ -56,7 +56,7 @@ pytest-cov = "^4"
 requests-mock = "^1.8.0"
 freezegun = "^1.5.1"
 pytz = "^2024.1"
-splunk-cim-models = {git = "https://github.com/splunk/psa-cim-models.git", branch = "v2"}
+splunk-cim-models = {git = "https://github.com/splunk/psa-cim-models.git", branch = "cim-6.4"}
 
 [tool.poetry.plugins]
 pytest11 = { plugin = "pytest_splunk_addon.plugin", "splunk" = "pytest_splunk_addon.splunk" }

tests/e2e/addons/TA_cim_addon/samples/test_change.xml

@@ -33,7 +33,10 @@
         <field name="user_type" value="Admin" />
         <field name="vendor_product" value="PSA" />
       </cim_fields>
-      <missing_recommended_fields />
+      <missing_recommended_fields>
+        <field>image_id</field>
+        <field>result_id</field>
+      </missing_recommended_fields>
     </cim>
   </event>
   <event code="" name="" format="">
@@ -66,7 +69,10 @@
         <field name="user_type" value="Admin" />
         <field name="vendor_product" value="PSA" />
       </cim_fields>
-      <missing_recommended_fields />
+      <missing_recommended_fields>
+        <field>image_id</field>
+        <field>result_id</field>
+      </missing_recommended_fields>
     </cim>
   </event>
   <event code="" name="" format="">
@@ -99,8 +105,13 @@
         <field name="vendor_product" value="PSA" />
       </cim_fields>
       <missing_recommended_fields>
+        <field>dest_nt_domain</field>
+        <field>image_id</field>
         <field>result</field>
+        <field>result_id</field>
+        <field>src_nt_domain</field>
         <field>src_user</field>
+        <field>src_user_name</field>
       </missing_recommended_fields>
     </cim>
   </event>

tests/e2e/addons/TA_req_broken/samples/syslog.xml

@@ -37,6 +37,7 @@
                 <field>src</field>
                 <field>src_ip</field>
                 <field>src_port</field>
+                <field>src_translated_ip</field>
                 <field>src_zone</field>
                 <field>src_interface</field>
                 <field>user</field>
@@ -82,6 +83,7 @@
                 <field>src</field>
                 <field>src_ip</field>
                 <field>src_port</field>
+                <field>src_translated_ip</field>
                 <field>src_zone</field>
                 <field>src_interface</field>
                 <field>user</field>

tests/e2e/constants.py

@@ -781,8 +781,6 @@
     '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication* PASSED*',
     '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::action* PASSED*',
     '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::app* PASSED*',
-    '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::dest* PASSED*',
-    '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src* PASSED*',
     '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src_user* PASSED*',
     '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::user* PASSED*',
     '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Failed_Authentication* PASSED*',
@@ -865,7 +863,6 @@
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_translated_ip* PASSED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_translated_ip+src_translated_ip* PASSED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_translated_port* PASSED*',
-    '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_zone* PASSED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::icmp_code* PASSED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::icmp_code+icmp_type* PASSED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::icmp_type* PASSED*',
@@ -882,8 +879,6 @@
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication* PASSED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::action* PASSED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::app* PASSED*',
-    '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src* PASSED*',
-    '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::dest* PASSED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src_user* PASSED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::user* PASSED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Failed_Authentication* PASSED*',
@@ -921,6 +916,7 @@
 Define the TA_broken add-on failed test case list.
 """
 TA_REQ_BROKEN_FAILED = [
+    '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_zone* FAILED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_zone+src_zone* FAILED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dvc* FAILED*',
     '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::protocol* FAILED*',
@@ -959,8 +955,8 @@
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::object* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::object_attrs* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::object_id* PASSED*',
+    '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::object_path* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::result* PASSED*',
-    '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::src* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::status* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::user* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::vendor_product* PASSED*',
@@ -976,8 +972,8 @@
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::object_attrs* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::object_category* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::object_id* PASSED*',
+    '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::object_path* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::result* PASSED*',
-    '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::src* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::status* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::user* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::vendor_product* PASSED*',
@@ -992,7 +988,6 @@
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_translated_ip* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_translated_ip+src_translated_ip* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_translated_port* PASSED*',
-    '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_zone* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_zone+src_zone* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::icmp_code* PASSED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::icmp_code+icmp_type* PASSED*',
@@ -1030,6 +1025,7 @@
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::action* FAILED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::app* FAILED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest* FAILED*',
+    '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_zone* FAILED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dvc* FAILED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::src* FAILED*',
     '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::transport* FAILED*',
@@ -1308,8 +1304,6 @@
     '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication* PASSED*',
     '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::action* PASSED*',
     '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::app* PASSED*',
-    '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::dest* PASSED*',
-    '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src* PASSED*',
     '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src_user* PASSED*',
     '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::user* PASSED*',
     '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Failed_Authentication* PASSED*',