mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
Bhavin Patel
@@ -1,401 +0,0 @@
|
||||
<dashboard version="2" theme="light">
|
||||
<label>ESCU - AppLocker</label>
|
||||
<description></description>
|
||||
<definition><![CDATA[
|
||||
{
|
||||
"dataSources": {
|
||||
"ds_search_1_new_new": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"query": "`applocker` \n| spath input=UserData_Xml path=RuleAndFileData.PolicyName output=PolicyName\n| spath input=UserData_Xml path=RuleAndFileData.RuleId output=RuleId\n| spath input=UserData_Xml path=RuleAndFileData.RuleName output=RuleName\n| spath input=UserData_Xml path=RuleAndFileData.RuleSddl output=RuleSddl\n| spath input=UserData_Xml path=RuleAndFileData.TargetUser output=TargetUser\n| spath input=UserData_Xml path=RuleAndFileData.TargetProcessId output=TargetProcessId\n| spath input=UserData_Xml path=RuleAndFileData.FilePath output=FilePath\n| spath input=UserData_Xml path=RuleAndFileData.Fqbn output=Fqbn\n| spath input=UserData_Xml path=RuleAndFileData.TargetLogonId output=TargetLogonId\n| spath input=UserData_Xml path=RuleAndFileData.FullFilePath output=FullFilePath\n| search PolicyName=*\n| table PolicyName, RuleId, RuleName, RuleSddl, TargetUser, TargetProcessId, FilePath, Fqbn, TargetLogonId, FullFilePath _time",
|
||||
"queryParameters": {
|
||||
"earliest": "$global_time.earliest$",
|
||||
"latest": "$global_time.latest$"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ds_search_1_new": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"query": "`applocker`\n\n| eval EventType=case(\n EventCode==8000, \"PolicyApplicationFailure\",\n EventCode==8001, \"PolicyApplicationSuccess\",\n EventCode==8002, \"AllowedFileExecution\",\n EventCode==8003, \"AuditedFileExecution\",\n EventCode==8004, \"BlockedFileExecution\",\n EventCode==8005, \"AllowedScriptOrMSIExecution\",\n EventCode==8006, \"AuditedScriptOrMSIExecution\",\n EventCode==8007, \"BlockedScriptOrMSIExecution\",\n EventCode==8020, \"AllowedPackagedApp\",\n EventCode==8021, \"AuditedPackagedApp\",\n EventCode==8022, \"DisabledPackagedApp\",\n EventCode==8023, \"AllowedPackagedAppInstallation\",\n EventCode==8024, \"AuditedPackagedAppInstallation\",\n EventCode==8025, \"DisabledPackagedAppInstallation\",\n EventCode==8027, \"NoPackagedAppRule\"\n)\n| table _time, host, EventCode, EventType\n| stats values(EventType) values(EventCode) count by host",
|
||||
"queryParameters": {
|
||||
"earliest": "$global_time.earliest$",
|
||||
"latest": "$global_time.latest$"
|
||||
}
|
||||
},
|
||||
"name": "eventcodereview"
|
||||
},
|
||||
"ds_search_1": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"query": "`applocker`\n| spath input=UserData_Xml | rename RuleAndFileData.* as *\n| lookup applockereventcodes EventCode OUTPUT Description\n| search PolicyName=$policyname$ EventCode=$eventcode$\n| stats values(host) AS dest by PolicyName, EventCode, Description, RuleId, RuleName, RuleSddl, TargetUser, TargetProcessId, FilePath, Fqbn, TargetLogonId, FullFilePath _time",
|
||||
"queryParameters": {
|
||||
"earliest": "$global_time.earliest$",
|
||||
"latest": "$global_time.latest$"
|
||||
}
|
||||
},
|
||||
"name": "policy_review"
|
||||
},
|
||||
"ds_YbLTfvcS": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"query": "`applocker` EventCode IN (8007, 8004, 8022, 8025, 8029, 8040)\n| spath input=UserData_Xml | rename RuleAndFileData.* as *\n| lookup applockereventcodes EventCode OUTPUT Description\n| stats count",
|
||||
"queryParameters": {
|
||||
"earliest": "$global_time.earliest$",
|
||||
"latest": "$global_time.latest$"
|
||||
}
|
||||
},
|
||||
"name": "blocks"
|
||||
},
|
||||
"ds_h2Fcom6o": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"query": "`applocker` EventCode IN (8003, 8006, 8021, 8024, 8039)\n| spath input=UserData_Xml | rename RuleAndFileData.* as *\n| lookup applockereventcodes EventCode OUTPUT Description\n| stats count"
|
||||
},
|
||||
"name": "Audit"
|
||||
},
|
||||
"ds_CAVvUpZ1": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"query": "`applocker` EventCode IN (8002, 8005, 8020, 8023, 8033, 8037)\n| spath input=UserData_Xml | rename RuleAndFileData.* as *\n| lookup applockereventcodes EventCode OUTPUT Description\n| stats count",
|
||||
"queryParameters": {
|
||||
"earliest": "$global_time.earliest$",
|
||||
"latest": "$global_time.latest$"
|
||||
}
|
||||
},
|
||||
"name": "allowed"
|
||||
}
|
||||
},
|
||||
"visualizations": {
|
||||
"viz_table_1_new": {
|
||||
"type": "splunk.table",
|
||||
"options": {
|
||||
"count": 20,
|
||||
"dataOverlayMode": "none",
|
||||
"drilldown": "none",
|
||||
"percentagesRow": false,
|
||||
"rowNumbers": false,
|
||||
"totalsRow": false,
|
||||
"wrap": true
|
||||
},
|
||||
"dataSources": {
|
||||
"primary": "ds_search_1_new"
|
||||
},
|
||||
"title": "EventCode Analysis"
|
||||
},
|
||||
"viz_table_1": {
|
||||
"type": "splunk.table",
|
||||
"options": {
|
||||
"count": 20,
|
||||
"dataOverlayMode": "none",
|
||||
"drilldown": "none",
|
||||
"percentagesRow": false,
|
||||
"rowNumbers": false,
|
||||
"totalsRow": false,
|
||||
"wrap": true
|
||||
},
|
||||
"dataSources": {
|
||||
"primary": "ds_search_1"
|
||||
},
|
||||
"title": "Policy Review"
|
||||
},
|
||||
"viz_oDemj4wG": {
|
||||
"type": "splunk.markdown",
|
||||
"options": {
|
||||
"markdown": "## AppLocker Event Code Reference\n- `8000` - Policy Application Failure: Indicates a problem with applying the policy.\n- `8001` - Policy Application Success: The policy has been applied successfully.\n- `8002` - Allowed File Execution: A file was allowed to run.\n- `8003` - Audited File Execution: A file was executed and logged for audit purposes.\n- `8004` - Blocked File Execution: A file was blocked from running.\n- `8005` - Allowed Script Or MSI Execution: A script or MSI was allowed to run.\n- `8006` - Audited Script Or MSI Execution: A script or MSI was executed and logged for audit purposes.\n- `8007` - Blocked Script Or MSI Execution: A script or MSI was blocked from running.\n- `8020` - Allowed Packaged App: A packaged app was allowed to run.\n- `8021` - Audited Packaged App: A packaged app was executed and logged for audit purposes.\n- `8022` - Disabled Packaged App: A packaged app was disabled from running.\n- `8023` - Allowed Packaged App Installation: Installation of a packaged app was permitted.\n- `8024` - Audited Packaged App Installation: Installation of a packaged app was audited.\n- `8025` - Disabled Packaged App Installation: Installation of a packaged app was disabled.\n- `8027` - No Packaged App Rule: No applicable rule was found for a packaged app.\n"
|
||||
}
|
||||
},
|
||||
"viz_7L8xsZTg": {
|
||||
"type": "splunk.singlevalue",
|
||||
"title": "Blocks",
|
||||
"dataSources": {
|
||||
"primary": "ds_YbLTfvcS"
|
||||
}
|
||||
},
|
||||
"viz_hAZfweZe": {
|
||||
"type": "splunk.singlevalue",
|
||||
"dataSources": {
|
||||
"primary": "ds_h2Fcom6o"
|
||||
},
|
||||
"title": "Audit"
|
||||
},
|
||||
"viz_xEjz65IP": {
|
||||
"type": "splunk.singlevalue",
|
||||
"title": "Allowed",
|
||||
"dataSources": {
|
||||
"primary": "ds_CAVvUpZ1"
|
||||
}
|
||||
}
|
||||
},
|
||||
"inputs": {
|
||||
"input_global_trp": {
|
||||
"type": "input.timerange",
|
||||
"options": {
|
||||
"token": "global_time",
|
||||
"defaultValue": "-24h@h,now"
|
||||
},
|
||||
"title": "Global Time Range"
|
||||
},
|
||||
"input_7M6KtkjS": {
|
||||
"options": {
|
||||
"items": [
|
||||
{
|
||||
"label": "All",
|
||||
"value": "*"
|
||||
},
|
||||
{
|
||||
"label": "APPX",
|
||||
"value": "appx"
|
||||
},
|
||||
{
|
||||
"label": "SCRIPT",
|
||||
"value": "script"
|
||||
},
|
||||
{
|
||||
"label": "EXE",
|
||||
"value": "exe"
|
||||
},
|
||||
{
|
||||
"label": "DLL",
|
||||
"value": "dll"
|
||||
},
|
||||
{
|
||||
"label": "MSI",
|
||||
"value": "msi"
|
||||
}
|
||||
],
|
||||
"token": "policyname",
|
||||
"defaultValue": "*"
|
||||
},
|
||||
"title": "Select Policy Name",
|
||||
"type": "input.dropdown"
|
||||
},
|
||||
"input_q9ZwkL2y": {
|
||||
"options": {
|
||||
"items": [
|
||||
{
|
||||
"label": "All",
|
||||
"value": "*"
|
||||
},
|
||||
{
|
||||
"label": "8000",
|
||||
"value": "8000"
|
||||
},
|
||||
{
|
||||
"label": "8001",
|
||||
"value": "8001"
|
||||
},
|
||||
{
|
||||
"label": "8002",
|
||||
"value": "8002"
|
||||
},
|
||||
{
|
||||
"label": "8003",
|
||||
"value": "8003"
|
||||
},
|
||||
{
|
||||
"label": "8004",
|
||||
"value": "8004"
|
||||
},
|
||||
{
|
||||
"label": "8005",
|
||||
"value": "8005"
|
||||
},
|
||||
{
|
||||
"label": "8006",
|
||||
"value": "8006"
|
||||
},
|
||||
{
|
||||
"label": "8007",
|
||||
"value": "8007"
|
||||
},
|
||||
{
|
||||
"label": "8008",
|
||||
"value": "8008"
|
||||
},
|
||||
{
|
||||
"label": "8020",
|
||||
"value": "8020"
|
||||
},
|
||||
{
|
||||
"label": "8021",
|
||||
"value": "8021"
|
||||
},
|
||||
{
|
||||
"label": "8022",
|
||||
"value": "8022"
|
||||
},
|
||||
{
|
||||
"label": "8023",
|
||||
"value": "8023"
|
||||
},
|
||||
{
|
||||
"label": "8024",
|
||||
"value": "8024"
|
||||
},
|
||||
{
|
||||
"label": "8025",
|
||||
"value": "8025"
|
||||
},
|
||||
{
|
||||
"label": "8027",
|
||||
"value": "8027"
|
||||
},
|
||||
{
|
||||
"label": "8028",
|
||||
"value": "8028"
|
||||
},
|
||||
{
|
||||
"label": "8029",
|
||||
"value": "8029"
|
||||
},
|
||||
{
|
||||
"label": "8030",
|
||||
"value": "8030"
|
||||
},
|
||||
{
|
||||
"label": "8031",
|
||||
"value": "8031"
|
||||
},
|
||||
{
|
||||
"label": "8032",
|
||||
"value": "8032"
|
||||
},
|
||||
{
|
||||
"label": "8033",
|
||||
"value": "8033"
|
||||
},
|
||||
{
|
||||
"label": "8034",
|
||||
"value": "8034"
|
||||
},
|
||||
{
|
||||
"label": "8035",
|
||||
"value": "8035"
|
||||
},
|
||||
{
|
||||
"label": "8036",
|
||||
"value": "8036"
|
||||
},
|
||||
{
|
||||
"label": "8037",
|
||||
"value": "8037"
|
||||
},
|
||||
{
|
||||
"label": "8038",
|
||||
"value": "8038"
|
||||
},
|
||||
{
|
||||
"label": "8039",
|
||||
"value": "8039"
|
||||
},
|
||||
{
|
||||
"label": "8040",
|
||||
"value": "8040"
|
||||
}
|
||||
],
|
||||
"defaultValue": "*",
|
||||
"token": "eventcode"
|
||||
},
|
||||
"title": "Select EventCode",
|
||||
"type": "input.dropdown"
|
||||
}
|
||||
},
|
||||
"layout": {
|
||||
"type": "grid",
|
||||
"options": {
|
||||
"submitButton": true,
|
||||
"submitOnDashboardLoad": true
|
||||
},
|
||||
"structure": [
|
||||
{
|
||||
"item": "viz_oDemj4wG",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 0,
|
||||
"y": 0,
|
||||
"w": 1200,
|
||||
"h": 179
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_7L8xsZTg",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 0,
|
||||
"y": 179,
|
||||
"w": 300,
|
||||
"h": 168
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_table_1",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 0,
|
||||
"y": 347,
|
||||
"w": 1200,
|
||||
"h": 682
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_table_1_new",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 0,
|
||||
"y": 1029,
|
||||
"w": 1200,
|
||||
"h": 736
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_hAZfweZe",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 300,
|
||||
"y": 179,
|
||||
"w": 300,
|
||||
"h": 168
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_xEjz65IP",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 600,
|
||||
"y": 179,
|
||||
"w": 600,
|
||||
"h": 168
|
||||
}
|
||||
}
|
||||
],
|
||||
"globalInputs": [
|
||||
"input_global_trp",
|
||||
"input_7M6KtkjS",
|
||||
"input_q9ZwkL2y"
|
||||
]
|
||||
},
|
||||
"title": "ESCU - AppLocker",
|
||||
"defaults": {
|
||||
"dataSources": {
|
||||
"ds.search": {
|
||||
"options": {
|
||||
"queryParameters": {
|
||||
"latest": "$global_time.latest$",
|
||||
"earliest": "$global_time.earliest$"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"description": "Utilize this dashboard to assist with auditing and monitoring Windows AppLocker events for your endpoints. Configure the applocker macro to use the AppLocker data source for populating the dashboard."
|
||||
}
|
||||
]]></definition>
|
||||
<meta type="hiddenElements"><![CDATA[
|
||||
{
|
||||
"hideEdit": false,
|
||||
"hideOpenInSearch": false,
|
||||
"hideExport": false
|
||||
}
|
||||
]]></meta>
|
||||
</dashboard>
|
||||
@@ -371,7 +371,6 @@
|
||||
"input_q9ZwkL2y"
|
||||
]
|
||||
},
|
||||
"title": "ESCU - AppLocker",
|
||||
"defaults": {
|
||||
"dataSources": {
|
||||
"ds.search": {
|
||||
@@ -384,5 +383,6 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"title": "AppLocker",
|
||||
"description": "Utilize this dashboard to assist with auditing and monitoring Windows AppLocker events for your endpoints. Configure the applocker macro to use the AppLocker data source for populating the dashboard."
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
name: AppLocker
|
||||
id: b13032c2-f0e2-48ee-8a85-ded8956c012a
|
||||
version: 1
|
||||
date: '2024-05-21'
|
||||
author: Michael Haag, Splunk
|
||||
description: Utilize this dashboard to assist with auditing and monitoring Windows AppLocker events for your endpoints. Configure the applocker macro to use the AppLocker data source for populating the dashboard.
|
||||
@@ -0,0 +1,680 @@
|
||||
{
|
||||
"visualizations": {
|
||||
"viz_total_overtime": {
|
||||
"type": "splunk.line",
|
||||
"options": {
|
||||
"yAxisAbbreviation": "off",
|
||||
"y2AxisAbbreviation": "off",
|
||||
"showRoundedY2AxisLabels": false,
|
||||
"legendTruncation": "ellipsisMiddle",
|
||||
"showY2MajorGridLines": true,
|
||||
"xAxisTitleText": "status",
|
||||
"xAxisTitleVisibility": "show",
|
||||
"yAxisTitleText": "count",
|
||||
"yAxisTitleVisibility": "show",
|
||||
"y2AxisTitleVisibility": "show",
|
||||
"seriesColorsByField": {},
|
||||
"legendDisplay": "off",
|
||||
"nullValueDisplay": "zero"
|
||||
},
|
||||
"dataSources": {
|
||||
"primary": "ds_2OvlCBpy"
|
||||
},
|
||||
"eventHandlers": [],
|
||||
"title": "RMM - Timechart",
|
||||
"showProgressBar": true,
|
||||
"description": "Count of total RMM detections in the environment over time ( unapproved / unknown )"
|
||||
},
|
||||
"viz_alert_by_analyst": {
|
||||
"type": "splunk.line",
|
||||
"dataSources": {
|
||||
"primary": "ds_YTrlswJz"
|
||||
},
|
||||
"eventHandlers": [
|
||||
{
|
||||
"type": "drilldown.linkToSearch",
|
||||
"options": {
|
||||
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature = $name|s$",
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$",
|
||||
"type": "custom",
|
||||
"newTab": true
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "RMM - Timechart by RMM",
|
||||
"showProgressBar": true,
|
||||
"description": "Count of unique RMM detections seen in the environment over time ( unapproved / unknown )",
|
||||
"options": {
|
||||
"nullValueDisplay": "zero"
|
||||
}
|
||||
},
|
||||
"viz_alert_by_host": {
|
||||
"type": "splunk.bar",
|
||||
"dataSources": {
|
||||
"primary": "ds_4jEl4LX9"
|
||||
},
|
||||
"eventHandlers": [
|
||||
{
|
||||
"type": "drilldown.linkToSearch",
|
||||
"options": {
|
||||
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature=$row.signature.value|s$",
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$",
|
||||
"type": "custom",
|
||||
"newTab": true
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "Top RMM Software",
|
||||
"showProgressBar": true,
|
||||
"description": "Most frequent RMM Software detections",
|
||||
"showLastUpdated": false,
|
||||
"options": {
|
||||
"legendDisplay": "off",
|
||||
"stackMode": "stacked"
|
||||
}
|
||||
},
|
||||
"viz_alert_by_user": {
|
||||
"type": "splunk.table",
|
||||
"dataSources": {
|
||||
"primary": "ds_SDnZFhvW"
|
||||
},
|
||||
"eventHandlers": [
|
||||
{
|
||||
"type": "drilldown.linkToSearch",
|
||||
"options": {
|
||||
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=$row.source.value|s$ signature=$row.signature.value|s$",
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$",
|
||||
"type": "custom",
|
||||
"newTab": true
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "Risk Detection Events",
|
||||
"showProgressBar": false,
|
||||
"showLastUpdated": false,
|
||||
"hideWhenNoData": true
|
||||
},
|
||||
"viz_5zPh9TFb": {
|
||||
"type": "splunk.singlevalue",
|
||||
"showProgressBar": false,
|
||||
"showLastUpdated": false,
|
||||
"title": "Unique RMM Software Detected",
|
||||
"description": "Count of unique RMM software seen",
|
||||
"dataSources": {
|
||||
"primary": "ds_9UEKEzwj"
|
||||
},
|
||||
"eventHandlers": [
|
||||
{
|
||||
"type": "drilldown.linkToSearch",
|
||||
"options": {
|
||||
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\"\n| stats count values(src) as src, values(dest) as dest, values(user) as user, values(process_name) as process_name, values(file_name) as file_name, values(url) as url by source,signature,_time \n| stats count by signature\n| sort - count",
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$",
|
||||
"type": "custom",
|
||||
"newTab": true
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"viz_B31XW5SU": {
|
||||
"type": "splunk.singlevalue",
|
||||
"title": "Monitored RRM Software",
|
||||
"description": "Total known and monitored RMM software",
|
||||
"dataSources": {
|
||||
"primary": "ds_XuRUkYYm"
|
||||
},
|
||||
"options": {},
|
||||
"context": {},
|
||||
"showProgressBar": false,
|
||||
"showLastUpdated": false,
|
||||
"eventHandlers": [
|
||||
{
|
||||
"type": "drilldown.linkToSearch",
|
||||
"options": {
|
||||
"query": "| inputlookup remote_access_software\n| stats values(*) as * by description\n| fields - last_update,isutility,category\n| sort description",
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$",
|
||||
"type": "custom",
|
||||
"newTab": true
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"viz_pmYQoySR": {
|
||||
"type": "splunk.singlevalue",
|
||||
"title": "Total RMM Software Detections",
|
||||
"dataSources": {
|
||||
"primary": "ds_0ZD3LOc8"
|
||||
},
|
||||
"showProgressBar": false,
|
||||
"showLastUpdated": false,
|
||||
"description": "Total risk detections fired for RMM software",
|
||||
"eventHandlers": [
|
||||
{
|
||||
"type": "drilldown.linkToSearch",
|
||||
"options": {
|
||||
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\"",
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$",
|
||||
"type": "custom",
|
||||
"newTab": true
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"viz_wWQo64yc": {
|
||||
"type": "splunk.singlevalue",
|
||||
"showProgressBar": false,
|
||||
"showLastUpdated": false,
|
||||
"title": "Monitoring Exceptions",
|
||||
"description": "Total count of exceptions made for RRM software",
|
||||
"dataSources": {
|
||||
"primary": "ds_I4IUb8eZ"
|
||||
},
|
||||
"eventHandlers": [
|
||||
{
|
||||
"type": "drilldown.linkToSearch",
|
||||
"options": {
|
||||
"query": "| inputlookup remote_access_software_exceptions",
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$",
|
||||
"type": "custom",
|
||||
"newTab": true
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"viz_8XkPozlC": {
|
||||
"type": "splunk.singlevalue",
|
||||
"title": "Total RMM Software Alerts",
|
||||
"dataSources": {
|
||||
"primary": "ds_AdgNL7xF"
|
||||
},
|
||||
"showProgressBar": false,
|
||||
"showLastUpdated": false,
|
||||
"description": "Total alerts triaged with RMM software detections",
|
||||
"eventHandlers": [
|
||||
{
|
||||
"type": "drilldown.customUrl",
|
||||
"options": {
|
||||
"url": "/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=$time_picker.earliest$&latest=$time_picker.latest$&search=%2522ESCU%2520-%2520Detect%2520Remote%2520Access%2520Software%2520Usage*%2522",
|
||||
"newTab": true
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"viz_xMCkeXlQ": {
|
||||
"type": "splunk.sankey",
|
||||
"dataSources": {
|
||||
"primary": "ds_LW7LiOhy"
|
||||
},
|
||||
"title": "Top Detections to RMM Software",
|
||||
"description": "RMM Software detection to software affinity"
|
||||
},
|
||||
"viz_NI1GGlJo": {
|
||||
"type": "splunk.bar",
|
||||
"dataSources": {
|
||||
"primary": "ds_rh3uALwl_ds_4jEl4LX9"
|
||||
},
|
||||
"eventHandlers": [
|
||||
{
|
||||
"type": "drilldown.linkToSearch",
|
||||
"options": {
|
||||
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature=$row.signature.value|s$",
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$",
|
||||
"type": "custom",
|
||||
"newTab": true
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "Rare RMM Software",
|
||||
"showProgressBar": true,
|
||||
"description": "Least seen RMM Software detections",
|
||||
"showLastUpdated": false,
|
||||
"options": {
|
||||
"stackMode": "stacked",
|
||||
"legendDisplay": "off"
|
||||
}
|
||||
},
|
||||
"viz_mOlKe0Wt": {
|
||||
"type": "splunk.singlevalue",
|
||||
"title": "Unique Users with $rmm_id$",
|
||||
"dataSources": {
|
||||
"primary": "ds_YUNfIx4j"
|
||||
},
|
||||
"hideWhenNoData": true,
|
||||
"options": {},
|
||||
"context": {},
|
||||
"showProgressBar": false,
|
||||
"showLastUpdated": false,
|
||||
"eventHandlers": [
|
||||
{
|
||||
"type": "drilldown.linkToSearch",
|
||||
"options": {
|
||||
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature IN ($rmm_id|s$)",
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$",
|
||||
"type": "custom",
|
||||
"newTab": true
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"viz_oaVWsWY8": {
|
||||
"type": "splunk.singlevalue",
|
||||
"title": "Unique Devices with $rmm_id$",
|
||||
"dataSources": {
|
||||
"primary": "ds_aBNX4sbQ"
|
||||
},
|
||||
"hideWhenNoData": true,
|
||||
"options": {},
|
||||
"context": {},
|
||||
"showProgressBar": false,
|
||||
"showLastUpdated": false,
|
||||
"eventHandlers": [
|
||||
{
|
||||
"type": "drilldown.linkToSearch",
|
||||
"options": {
|
||||
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\" signature IN ($rmm_id|s$)",
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$",
|
||||
"type": "custom",
|
||||
"newTab": true
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"dataSources": {
|
||||
"ds_archiveSearch": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"query": "| from datamodel:\"Risk\".\"All_Risk\" | search source=\"ESCU - Detect Remote Access Software Usage*\"\n| stats count values(src) as src, values(dest) as dest, values(user) as user, values(process_name) as process_name, values(file_name) as file_name, values(url) as url by source,signature,_time",
|
||||
"queryParameters": {
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$"
|
||||
}
|
||||
},
|
||||
"name": "ds_rmm_risk_search"
|
||||
},
|
||||
"ds_vqe1IpW4": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"query": "| tstats summariesonly=true count from datamodel=Risk.All_Risk where source=\"ESCU - Detect Remote Access Software Usage*\" by source \n| `drop_dm_object_name(\"All_Risk\")`",
|
||||
"queryParameters": {
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$"
|
||||
}
|
||||
},
|
||||
"name": "ds_alert_search"
|
||||
},
|
||||
"ds_4kVqbyrH": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"queryParameters": {
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$"
|
||||
},
|
||||
"query": "| inputlookup remote_access_software\n| stats count by description\n| rename description as rmm_software"
|
||||
},
|
||||
"name": "ds_known_rmm_software"
|
||||
},
|
||||
"ds_fbY2wV7Q": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"queryParameters": {
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$"
|
||||
},
|
||||
"query": "| tstats summariesonly=true count from datamodel=Risk.All_Risk where source = \"ESCU - Detect Remote Access Software Usage*\" by source,_time"
|
||||
},
|
||||
"name": "ds_rmm_risk_tstats_search"
|
||||
},
|
||||
"ds_YTrlswJz": {
|
||||
"type": "ds.chain",
|
||||
"options": {
|
||||
"extend": "ds_archiveSearch",
|
||||
"query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| timechart sum(count) by signature useother=false limit=20"
|
||||
},
|
||||
"name": "rmm_timechart_by_rmm"
|
||||
},
|
||||
"ds_2OvlCBpy": {
|
||||
"type": "ds.chain",
|
||||
"options": {
|
||||
"extend": "ds_archiveSearch",
|
||||
"query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| timechart sum(count) as total_rmm"
|
||||
},
|
||||
"name": "rmm_timechart_total"
|
||||
},
|
||||
"ds_LW7LiOhy": {
|
||||
"type": "ds.chain",
|
||||
"options": {
|
||||
"extend": "ds_archiveSearch",
|
||||
"query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| top limit=20 source,signature"
|
||||
},
|
||||
"name": "rmm_sankey"
|
||||
},
|
||||
"ds_axWH8wT0": {
|
||||
"type": "ds.chain",
|
||||
"options": {
|
||||
"extend": "ds_4kVqbyrH"
|
||||
},
|
||||
"name": "total_rmm_lookup"
|
||||
},
|
||||
"ds_XuRUkYYm": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"queryParameters": {
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$"
|
||||
},
|
||||
"query": "| inputlookup remote_access_software\n| stats count by description\n| stats count"
|
||||
},
|
||||
"name": "ds_rmm_software_total"
|
||||
},
|
||||
"ds_I4IUb8eZ": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"queryParameters": {
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$"
|
||||
},
|
||||
"query": "| inputlookup remote_access_software_exceptions\n| stats count"
|
||||
},
|
||||
"name": "ds_rmm_exception_total"
|
||||
},
|
||||
"ds_0ZD3LOc8": {
|
||||
"type": "ds.chain",
|
||||
"options": {
|
||||
"extend": "ds_archiveSearch",
|
||||
"query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| stats sum(count) as count "
|
||||
},
|
||||
"name": "rmm_total_detections"
|
||||
},
|
||||
"ds_9UEKEzwj": {
|
||||
"type": "ds.chain",
|
||||
"options": {
|
||||
"extend": "ds_archiveSearch",
|
||||
"query": "| stats count by signature\n| stats count"
|
||||
},
|
||||
"name": "rmm_count_by_rmm"
|
||||
},
|
||||
"ds_AdgNL7xF": {
|
||||
"type": "ds.search",
|
||||
"options": {
|
||||
"queryParameters": {
|
||||
"earliest": "$time_picker.earliest$",
|
||||
"latest": "$time_picker.latest$"
|
||||
},
|
||||
"query": "index=notable | search orig_source=\"ESCU - Detect Remote Access Software Usage*\"\n| stats count"
|
||||
},
|
||||
"name": "total_notable_rmm"
|
||||
},
|
||||
"ds_SDnZFhvW": {
|
||||
"type": "ds.chain",
|
||||
"options": {
|
||||
"extend": "ds_archiveSearch",
|
||||
"query": "| eval search_break = case(\"*\" IN ($rmm_id|s$),\"search_break\")\n| search source IN ($alert_name|s$) signature IN ($rmm_id|s$) NOT search_break = \"search_break\"\n| fields - search_break\n"
|
||||
},
|
||||
"name": "rmm_full_table_data"
|
||||
},
|
||||
"ds_4jEl4LX9": {
|
||||
"type": "ds.chain",
|
||||
"options": {
|
||||
"extend": "ds_archiveSearch",
|
||||
"query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| top limit=10 signature\n| eval series=signature \n| chart values(count) over signature by series limit=100 useother=false\n| `sort_chart`\n\n",
|
||||
"enableSmartSources": true
|
||||
},
|
||||
"name": "rmm_top"
|
||||
},
|
||||
"ds_rh3uALwl_ds_4jEl4LX9": {
|
||||
"type": "ds.chain",
|
||||
"options": {
|
||||
"extend": "ds_archiveSearch",
|
||||
"query": "| search source IN ($alert_name|s$) signature IN ($rmm_id|s$)\n| rare limit=10 signature\n| eval series=signature \n| chart values(count) over signature by series limit=100 useother=false\n| `sort_chart`\n"
|
||||
},
|
||||
"name": "rmm_rare"
|
||||
},
|
||||
"ds_YUNfIx4j": {
|
||||
"type": "ds.chain",
|
||||
"options": {
|
||||
"extend": "ds_archiveSearch",
|
||||
"query": "| eval search_break = case(\"*\" IN ($rmm_id|s$),\"search_break\"), user = upper(user)\n| search source IN ($alert_name|s$) signature IN ($rmm_id|s$) NOT search_break = \"search_break\"\n| fields - search_break\n| stats count by user\n| search NOT user IN (\"unknown\",\"*$\")\n| stats count\n| where count > 0"
|
||||
},
|
||||
"name": "rmm_unique_users"
|
||||
},
|
||||
"ds_aBNX4sbQ": {
|
||||
"type": "ds.chain",
|
||||
"options": {
|
||||
"extend": "ds_archiveSearch",
|
||||
"query": "| eval devices = upper(case(isnotnull(src),src,true(),dest))\n| eval search_break = case(\"*\" IN ($rmm_id|s$),\"search_break\")\n| search source IN ($alert_name|s$) signature IN ($rmm_id|s$) NOT search_break = \"search_break\"\n| fields - search_break\n| stats dc(devices) as count\n| where count > 0"
|
||||
},
|
||||
"name": "rmm_unique_devices"
|
||||
}
|
||||
},
|
||||
"inputs": {
|
||||
"input_AqBjBRiF": {
|
||||
"type": "input.multiselect",
|
||||
"options": {
|
||||
"clearDefaultOnSelection": "TRUE",
|
||||
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
|
||||
"token": "alert_name",
|
||||
"defaultValue": [
|
||||
"*"
|
||||
]
|
||||
},
|
||||
"title": "Alert Name",
|
||||
"context": {
|
||||
"formattedConfig": {
|
||||
"number": {
|
||||
"prefix": ""
|
||||
}
|
||||
},
|
||||
"formattedStatics": ">statics | formatByType(formattedConfig)",
|
||||
"statics": [
|
||||
[
|
||||
"All"
|
||||
],
|
||||
[
|
||||
"*"
|
||||
]
|
||||
],
|
||||
"label": ">primary | seriesByName(\"source\") | renameSeries(\"label\") | formatByType(formattedConfig)",
|
||||
"value": ">primary | seriesByName(\"source\") | renameSeries(\"value\") | formatByType(formattedConfig)"
|
||||
},
|
||||
"dataSources": {
|
||||
"primary": "ds_vqe1IpW4"
|
||||
}
|
||||
},
|
||||
"input_adFMvLPg": {
|
||||
"type": "input.multiselect",
|
||||
"options": {
|
||||
"clearDefaultOnSelection": "TRUE",
|
||||
"defaultValue": "*",
|
||||
"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
|
||||
"token": "rmm_id"
|
||||
},
|
||||
"title": "RMM Software",
|
||||
"context": {
|
||||
"formattedConfig": {
|
||||
"number": {
|
||||
"prefix": ""
|
||||
}
|
||||
},
|
||||
"formattedStatics": ">statics | formatByType(formattedConfig)",
|
||||
"statics": [
|
||||
[
|
||||
"All"
|
||||
],
|
||||
[
|
||||
"*"
|
||||
]
|
||||
],
|
||||
"label": ">primary | seriesByName(\"rmm_software\") | renameSeries(\"label\") | formatByType(formattedConfig)",
|
||||
"value": ">primary | seriesByName(\"rmm_software\") | renameSeries(\"value\") | formatByType(formattedConfig)"
|
||||
},
|
||||
"dataSources": {
|
||||
"primary": "ds_4kVqbyrH"
|
||||
}
|
||||
},
|
||||
"input_ZIvNCkgw": {
|
||||
"type": "input.timerange",
|
||||
"options": {
|
||||
"token": "time_picker",
|
||||
"defaultValue": "-7d@h,now"
|
||||
},
|
||||
"title": "Time Range"
|
||||
}
|
||||
},
|
||||
"layout": {
|
||||
"type": "grid",
|
||||
"options": {
|
||||
"height": 1000,
|
||||
"width": 1440,
|
||||
"gutterSize": 10
|
||||
},
|
||||
"structure": [
|
||||
{
|
||||
"item": "viz_B31XW5SU",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 0,
|
||||
"y": 0,
|
||||
"w": 287,
|
||||
"h": 161
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_total_overtime",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 0,
|
||||
"y": 161,
|
||||
"w": 720,
|
||||
"h": 265
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_alert_by_host",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 0,
|
||||
"y": 426,
|
||||
"w": 476,
|
||||
"h": 437
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_mOlKe0Wt",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 0,
|
||||
"y": 863,
|
||||
"w": 720,
|
||||
"h": 140
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_alert_by_user",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 0,
|
||||
"y": 1003,
|
||||
"w": 1440,
|
||||
"h": 476
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_5zPh9TFb",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 287,
|
||||
"y": 0,
|
||||
"w": 279,
|
||||
"h": 161
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_NI1GGlJo",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 476,
|
||||
"y": 426,
|
||||
"w": 485,
|
||||
"h": 437
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_pmYQoySR",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 566,
|
||||
"y": 0,
|
||||
"w": 314,
|
||||
"h": 161
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_alert_by_analyst",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 720,
|
||||
"y": 161,
|
||||
"w": 720,
|
||||
"h": 265
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_oaVWsWY8",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 720,
|
||||
"y": 863,
|
||||
"w": 720,
|
||||
"h": 140
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_8XkPozlC",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 880,
|
||||
"y": 0,
|
||||
"w": 295,
|
||||
"h": 161
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_xMCkeXlQ",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 961,
|
||||
"y": 426,
|
||||
"w": 479,
|
||||
"h": 437
|
||||
}
|
||||
},
|
||||
{
|
||||
"item": "viz_wWQo64yc",
|
||||
"type": "block",
|
||||
"position": {
|
||||
"x": 1175,
|
||||
"y": 0,
|
||||
"w": 265,
|
||||
"h": 161
|
||||
}
|
||||
}
|
||||
],
|
||||
"globalInputs": [
|
||||
"input_AqBjBRiF",
|
||||
"input_adFMvLPg",
|
||||
"input_ZIvNCkgw"
|
||||
]
|
||||
},
|
||||
"description": "Utilize this dashboard to assist with auditing and monitoring of Remote Monitoring and Management (RMM) alert content.",
|
||||
"title": "RMM Software Tracking"
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
name: RMM Software Tracking
|
||||
id: 824b748b-9746-4247-b02b-f0961d6f54a5
|
||||
version: 1
|
||||
date: '2024-08-05'
|
||||
author: Steven Dick, Github Community
|
||||
description: Utilize this dashboard to assist with auditing and monitoring of Remote Monitoring and Management (RMM) alert content.
|
||||
Reference in New Issue
Block a user