Data Source: Cisco Network Visibility Module Flow Data

Date: 2026-07-14

ID: d49bcd3c-da06-41c6-b33e-8b8d23078f68

Author: Nasreddine Bencherchali, Splunk

Description

Data source object for Netflow events from Cisco Network Visibility Module

Details

Property	Value
Source	`not_applicable`
Sourcetype	`cisco:nvm:flowdata:v2`

Name ▲▼	Technique ▲▼	Type ▲▼
Windows InstallUtil URL in Command Line	InstallUtil	TTP
Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download	Mshta	Anomaly
Cisco NVM - Susp Script From Archive Triggering Network Activity	Visual Basic, Malicious File	Anomaly
Windows PowerShell FakeCAPTCHA Clipboard Execution	PowerShell, Windows Command Shell, Malicious Link	TTP
Cisco NVM - Outbound Connection to Suspicious Port	Non-Standard Port	Anomaly
Windows HTTP Network Communication From MSIExec	Msiexec	Anomaly
Cisco NVM - Suspicious Network Connection to IP Lookup Service API	System Network Configuration Discovery, IP Addresses	Anomaly
Cisco NVM - Curl Execution With Insecure Flags	BITS Jobs	Anomaly
WMIC XSL Execution via URL	XSL Script Processing	TTP
Windows Curl Upload to Remote Destination	Ingress Tool Transfer	TTP
Cisco NVM - Suspicious File Download via Headless Browser	Command and Scripting Interpreter, Ingress Tool Transfer	TTP
Cisco NVM - Suspicious Network Connection From Process With No Args	Process Injection, System Binary Proxy Execution	Anomaly
Windows File Download Via CertUtil	Ingress Tool Transfer	TTP
Detect HTML Help URL in Command Line	Compiled HTML File	TTP
Windows Curl Download to Suspicious Path	Ingress Tool Transfer	TTP
Cisco NVM - Non-Network Binary Making Network Connection	Masquerading, Process Injection	Anomaly
Cisco NVM - Suspicious Network Connection Initiated via MsXsl	XSL Script Processing	Anomaly
Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI	Visual Basic, Mshta	Anomaly
Windows MSIExec Remote Download	Msiexec	Anomaly
Cisco NVM - Installation of Typosquatted Python Package	Command and Scripting Interpreter	TTP
Cisco NVM - Suspicious Download From File Sharing Website	BITS Jobs	Anomaly
Detect RClone Command-Line Usage	Automated Exfiltration	TTP
Windows File Download Via PowerShell	PowerShell, Ingress Tool Transfer	Anomaly
Attacker Tools On Endpoint	OS Credential Dumping, Match Legitimate Resource Name or Location, Active Scanning	TTP
Windows InstallUtil Remote Network Connection	InstallUtil	Anomaly
Detect MSHTA Url in Command Line	Mshta	TTP
Cisco NVM - Rclone Execution With Network Activity	Exfiltration to Cloud Storage	Anomaly
Cisco NVM - Webserver Download From File Sharing Website	Ingress Tool Transfer, Exploit Public-Facing Application	TTP

Supported Apps

Cisco Security Cloud (version 4.0.0)

Event Fields

+ Fields

  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">aliul</span>
  
  <span class="pill kill-chain">bytes</span>
  
  <span class="pill kill-chain">bytes_in</span>
  
  <span class="pill kill-chain">bytes_out</span>
  
  <span class="pill kill-chain">da</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">deserialize</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dest_hostname</span>
  
  <span class="pill kill-chain">dest_ip</span>
  
  <span class="pill kill-chain">dest_ipv6</span>
  
  <span class="pill kill-chain">dest_port</span>
  
  <span class="pill kill-chain">dh</span>
  
  <span class="pill kill-chain">direction</span>
  
  <span class="pill kill-chain">dp</span>
  
  <span class="pill kill-chain">dps</span>
  
  <span class="pill kill-chain">ds</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">fd</span>
  
  <span class="pill kill-chain">fems</span>
  
  <span class="pill kill-chain">fes</span>
  
  <span class="pill kill-chain">fet</span>
  
  <span class="pill kill-chain">field</span>
  
  <span class="pill kill-chain">flow_dns_suffix</span>
  
  <span class="pill kill-chain">flow_end_msec</span>
  
  <span class="pill kill-chain">flow_end_sec</span>
  
  <span class="pill kill-chain">flow_end_time</span>
  
  <span class="pill kill-chain">flow_report_stage</span>
  
  <span class="pill kill-chain">flow_start_msec</span>
  
  <span class="pill kill-chain">flow_start_sec</span>
  
  <span class="pill kill-chain">flow_start_time</span>
  
  <span class="pill kill-chain">flow_version</span>
  
  <span class="pill kill-chain">fsg</span>
  
  <span class="pill kill-chain">fsms</span>
  
  <span class="pill kill-chain">fss</span>
  
  <span class="pill kill-chain">fst</span>
  
  <span class="pill kill-chain">fv</span>
  
  <span class="pill kill-chain">hh</span>
  
  <span class="pill kill-chain">hm</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">ht</span>
  
  <span class="pill kill-chain">http_host</span>
  
  <span class="pill kill-chain">http_method</span>
  
  <span class="pill kill-chain">ibc</span>
  
  <span class="pill kill-chain">iid</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">liuat</span>
  
  <span class="pill kill-chain">liuid</span>
  
  <span class="pill kill-chain">liuida</span>
  
  <span class="pill kill-chain">liuidp</span>
  
  <span class="pill kill-chain">logged_in_user</span>
  
  <span class="pill kill-chain">logged_in_user_account_type</span>
  
  <span class="pill kill-chain">logged_in_user_authority</span>
  
  <span class="pill kill-chain">logged_in_user_principal</span>
  
  <span class="pill kill-chain">mhl</span>
  
  <span class="pill kill-chain">mnl</span>
  
  <span class="pill kill-chain">module_hash_list</span>
  
  <span class="pill kill-chain">module_name_list</span>
  
  <span class="pill kill-chain">obc</span>
  
  <span class="pill kill-chain">pa</span>
  
  <span class="pill kill-chain">paa</span>
  
  <span class="pill kill-chain">pap</span>
  
  <span class="pill kill-chain">parent_process</span>
  
  <span class="pill kill-chain">parent_process_account</span>
  
  <span class="pill kill-chain">parent_process_arguments</span>
  
  <span class="pill kill-chain">parent_process_hash</span>
  
  <span class="pill kill-chain">parent_process_id</span>
  
  <span class="pill kill-chain">parent_process_integrity_level</span>
  
  <span class="pill kill-chain">parent_process_name</span>
  
  <span class="pill kill-chain">parent_process_path</span>
  
  <span class="pill kill-chain">parent_process_user_account_type</span>
  
  <span class="pill kill-chain">parg</span>
  
  <span class="pill kill-chain">ph</span>
  
  <span class="pill kill-chain">pid</span>
  
  <span class="pill kill-chain">pil</span>
  
  <span class="pill kill-chain">pn</span>
  
  <span class="pill kill-chain">ppa</span>
  
  <span class="pill kill-chain">pparg</span>
  
  <span class="pill kill-chain">ppath</span>
  
  <span class="pill kill-chain">pph</span>
  
  <span class="pill kill-chain">ppid</span>
  
  <span class="pill kill-chain">ppil</span>
  
  <span class="pill kill-chain">ppn</span>
  
  <span class="pill kill-chain">pppath</span>
  
  <span class="pill kill-chain">ppuat</span>
  
  <span class="pill kill-chain">pr</span>
  
  <span class="pill kill-chain">process</span>
  
  <span class="pill kill-chain">process_account_authority</span>
  
  <span class="pill kill-chain">process_account_principal</span>
  
  <span class="pill kill-chain">process_arguments</span>
  
  <span class="pill kill-chain">process_guid</span>
  
  <span class="pill kill-chain">process_hash</span>
  
  <span class="pill kill-chain">process_id</span>
  
  <span class="pill kill-chain">process_integrity_level</span>
  
  <span class="pill kill-chain">process_name</span>
  
  <span class="pill kill-chain">process_path</span>
  
  <span class="pill kill-chain">process_user_account_type</span>
  
  <span class="pill kill-chain">protocol_identifier</span>
  
  <span class="pill kill-chain">puat</span>
  
  <span class="pill kill-chain">puid</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">sa</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">sp</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">splunk_server_group</span>
  
  <span class="pill kill-chain">sps</span>
  
  <span class="pill kill-chain">src</span>
  
  <span class="pill kill-chain">src_interface</span>
  
  <span class="pill kill-chain">src_ip</span>
  
  <span class="pill kill-chain">src_ipv6</span>
  
  <span class="pill kill-chain">src_port</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::action</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestamp</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">transport</span>
  
  <span class="pill kill-chain">udid</span>
  
  <span class="pill kill-chain">uri_path</span>
  
  <span class="pill kill-chain">user</span>
  
</div>

Example Log

1{ "fv": "nvzFlow_v11", "pr": "6", "sa": "10.10.0.38", "sp": "37351", "da": "104.114.110.196", "dp": "80", "fd": "1", "fss": "1784017733", "fst": "Tue Jul 14 13:58:53 2026", "fes": "1784017793", "fet": "Tue Jul 14 13:59:53 2026", "hh": "tile-service.weather.microsoft.com", "hm": "GET", "ht": "/en-GB/livetile/preinstall", "udid": "D5E5634FDBEE82655C9C0E7523CDCE62A8249A1C", "liuid": "WIN-ANIKET\\Hostscan", "liuida": "WIN-ANIKET", "liuidp": "Hostscan", "liuat": "2", "pa": "WIN-ANIKET\\Hostscan", "puat": "2", "pn": "svchost.exe", "ph": "B0B36BFF7AE4057F687D839CD4B3D81159AB646F1EE1B22106A927E93DECBB61", "pid": "3040", "ppath": "C:\\Windows\\System32\\svchost.exe", "parg": "-k UnistackSvcGroup -s WpnUserService", "ppn": "services.exe", "ppid": "684", "pppath": "C:\\Windows\\System32\\services.exe", "ibc": "7660", "obc": "213", "ds": "cisco.com", "dh": "tile-service.weather.microsoft.com", "iid": "50", "mnl": "wpnuserservice.dll", "mhl": "8F571F1D23DE5D0C223338BDD341892CCBC62FDE443499AC373B6A621F58A332", "fsms": "1784017733536", "fems": "1784017793545", "pil": "8192", "ppil": "16384", "fsg": "0", "puid": "E89CC0DBD1F48055BB4FA09268E9B51D", "eveuuid": "00000000000000000000000000000000" }

Required Output Fields

dest

Source: GitHub | Version: 3