Cyberwatch Syslog Add-on for Splunk

The Cyberwatch Syslog Add-on normalizes vulnerability detection data sent by Cyberwatch appliances over syslog into the Splunk Common Information Model. It provides field extractions, index-time configuration, and CIM compliance for the Vulnerabilities data model, enabling integration with Splunk Enterprise Security and IT operations workflows. The add-on handles the cyberwatch:syslog sourcetype and includes timestamp recognition, field extraction rules, and CIM tagging to ensure vulnerability events are properly structured for downstream analysis. It contains configuration files only, with no custom scripts or user interface components.