UTM-TA-Mita

The UTM-TA-Mita add-on normalizes and extracts fields from MitaUTM firewall logs, enabling security and network operations teams to analyze firewall activity within Splunk. This add-on processes logs across multiple MitaUTM components including packet filtering, DHCP services, OpenVPN connections, Nginx web proxy traffic, and Unbound DNS resolution. It maps extracted fields to the Common Information Model (CIM) for Authentication, Network Traffic, and Network Resolution data models, allowing the normalized data to work seamlessly with Splunk Enterprise Security and other CIM-dependent applications. By standardizing MitaUTM log formats into CIM-compliant fields and applying appropriate event tags, this add-on enables correlation of firewall events with other security data sources and supports use cases such as threat detection, VPN monitoring, web activity analysis, and DNS query tracking.