According to Splunk CIM documentation, which field in the Authentication Data Model represents the user who initiated a privilege escalation?

Question

Options

• Ausername
• Bsrc_user_id
• Csrc_user
• Ddest_user

• B
  5% (1)
• C
  90% (19)
• D
  5% (1)

Explanation

src_user is the CIM-designated field for the user initiating a privilege escalation - the "source" of the action - following Splunk's consistent src/dest naming convention across data models. In a sudo or runas scenario, src_user captures the account requesting elevated privileges, while dest_user captures the privileged account being assumed (e.g., root or Administrator), making the two complementary but distinct.

Why the distractors are wrong:

• A. username - a generic authentication field for the user involved in login events; it lacks the directional specificity needed for privilege escalation.
• B. src_user_id - not a standard field in the CIM Authentication Data Model; CIM uses src_user (the name), not a separate ID variant, for this role.
• D. dest_user - represents the target privileged account being escalated to, not the user who initiated the escalation.

Memory tip: Think of privilege escalation like a network connection - traffic always flows from src (source, the initiating user) to dest (destination, the privileged account). The person doing the escalating is always the source (src_user).

No community discussion yet for this question.